9

When I Use the Retire.js Chrome plugin I get a warning that the jQuery 1.7.1 (from November 2011) included on Stack Exchange is vulnerable to 'Selector interpreted as HTML' (jQuery bug 11290)

Besides this vulnerability which may or may not apply, is it not time to upgrade to a newer version ?

Feature request please :)

Improve this question
8
  • related, but old : meta.stackexchange.com/questions/115390/…
    – rjdkolb
    Commented Nov 20, 2015 at 6:11
  • Balpha says it himself: if it ain't broken, don't fix it.
    – Patrick Hofman
    Commented Nov 20, 2015 at 6:29
  • But if it has a possible security flaw ? (I am no jQuery expert)
    – rjdkolb
    Commented Nov 20, 2015 at 6:31
  • Do they even use that part of jQuery?
    – Patrick Hofman
    Commented Nov 20, 2015 at 6:42
  • 1
    @PatrickHofman Indeed they do e.g. $('#post-form') 14 times on this page
    – rjdkolb
    Commented Nov 20, 2015 at 6:45
  • 2
    @rjdkolb: It appears, superficially, as though the bug is really only relevant if there's a < (parent selector) character somewhere in there. Does SE code do anything with those?
    – Nathan Tuggy
    Commented Nov 20, 2015 at 6:53
  • 1
    @NathanTuggy, not that I can see directly. I asked a question on Stackoverflow stackoverflow.com/questions/33756121/… With the dynamic nature of Stack Exchange, this may be possible. (Again I am not a jQuery expert)
    – rjdkolb
    Commented Nov 20, 2015 at 7:01
  • 4
    meta.stackexchange.com/questions/284996/…
    – rjdkolb
    Commented Sep 27, 2016 at 5:06

0

Reset to default

Browse other questions tagged .