| Summary: | error-report-web: upgrade Bootstrap 2.3.2 -> 3.4.1 and jQuery 1.10.2 -> 3.7.1 | ||
|---|---|---|---|
| Product: | [Yocto Project Subprojects] Error Reporting tool | Reporter: | Tim Orling <tim.orling> |
| Component: | Error Reporting Tool | Assignee: | Tim Orling <TicoTimo> |
| Status: | IN PROGRESS REVIEW --- | QA Contact: | |
| Severity: | normal | ||
| Priority: | Medium+ | ||
| Version: | 6.2 | ||
| Target Milestone: | 6.2 M1 | ||
| Hardware: | x86 | ||
| OS: | Multiple | ||
| Whiteboard: | |||
| OS type for building Yocto: | --- | Type of Regression: | --- |
| Verified: | Documentation change: | Don't know | |
error-report-web ships Bootstrap 2.3.2 (2013) and jQuery 1.10.2 (2013) in Post/static/. Neither has received fixes for years, and both have published XSS vulnerabilities, for example: jQuery < 3.5.0: CVE-2015-9251, CVE-2019-11358, CVE-2020-11022, CVE-2020-11023 Bootstrap < 3.4.1: CVE-2018-14040, CVE-2018-14041, CVE-2018-14042, CVE-2019-8331 Most of these need untrusted data passed to particular jQuery/Bootstrap APIs or data-* attributes. Related hardening is already staging in my master-next: a Content Security Policy, tooltips that no longer render HTML, the commit popover built as text, and escaping on output instead of bleach. Upgrading removes the vulnerable code itself, and puts error-report-web on the same front-end versions as layerindex-web, which uses Bootstrap 3.4.1 and jQuery 3.7.1.