[wp-trac] [WordPress Trac] #50242: update jQuery version string in file to confirm not stock 1.12.4?

WordPress Trac noreply at wordpress.org
Mon May 25 07:25:19 UTC 2020


#50242: update jQuery version string in file to confirm not stock 1.12.4?
--------------------------------+-----------------------------
 Reporter:  OptimizingMatters   |      Owner:  (none)
     Type:  defect (bug)        |     Status:  new
 Priority:  normal              |  Milestone:  Awaiting Review
Component:  External Libraries  |    Version:
 Severity:  normal              |   Keywords:
  Focuses:                      |
--------------------------------+-----------------------------
 This is a follow-up to #47020.

 The security test at https://snyk.io (which is now included in the
 webpagetest.org tests) detects jQuery as vulnerable in spite of the
 security fixes having been backported and results in a big red F for
 security on the webpagetest.org test page.

 jQuery is now requested as "wp-includes/js/jquery/jquery.js?ver=1.12.4-wp"
 but the file itself does not have that "-wp" string appended in the
 version string, making it harder for tools not see this is not stock
 jQuery 1.12.4:

 /*! jQuery v1.12.4 | (c) jQuery Foundation | jquery.org/license |
 WordPress 2019-05-16 */

 updating this into
 /*! jQuery v1.12.4-wp | (c) jQuery Foundation | jquery.org/license |
 WordPress 2019-05-16 */

 could make it easier for tools such as Snyk to distinguish between patched
 and vulnerable version?

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/50242>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform


More information about the wp-trac mailing list