Upgrade jQuery past known vulnerabilities #511
Description
Thanks for Deform; lovely work!
An question/issue re the jQuery versuib and security:
- The current version of Deform (2.0.15) ships with
static/scripts/jquery-2.0.3.min.js. - The advice is to load this from
<head>tags of pages using Deform, as per https://docs.pylonsproject.org/projects/deform/en/2.0-branch/basics.html#serving-up-the-rendered-form. - However, jQuery 2.0.3 has known cross-site scripting vulnerabilities: https://snyk.io/vuln/npm:jquery and http://www.cvedetails.com/vulnerability-list/vendor_id-6538/Jquery.html.
This was pointed out to us by a penetration testing company. They note that the potential exploit methods are complex, but I'm afraid I don't know whether this is in effect a false positive or whether it is a real concern. However, on the assumption that they are right:
Could Deform ship with a more recent jQuery version? I note this is clearly not as simple as dropping in the current version (3.6.0 does not work)! Many thanks for thinking about this.