9

When I Use the Retire.js Chrome plugin I get a warning that the jQuery 1.7.1 (from November 2011) included on Stack Exchange is vulnerable to 'Selector interpreted as HTML' (jQuery bug 11290)

Besides this vulnerability which may or may not apply, is it not time to upgrade to a newer version ?

Feature request please :)

8
  • related, but old : meta.stackexchange.com/questions/115390/…
    – rjdkolb
    Nov 20, 2015 at 6:11
  • Balpha says it himself: if it ain't broken, don't fix it. Nov 20, 2015 at 6:29
  • But if it has a possible security flaw ? (I am no jQuery expert)
    – rjdkolb
    Nov 20, 2015 at 6:31
  • Do they even use that part of jQuery? Nov 20, 2015 at 6:42
  • 1
    @PatrickHofman Indeed they do e.g. $('#post-form') 14 times on this page
    – rjdkolb
    Nov 20, 2015 at 6:45
  • 2
    @rjdkolb: It appears, superficially, as though the bug is really only relevant if there's a < (parent selector) character somewhere in there. Does SE code do anything with those? Nov 20, 2015 at 6:53
  • 1
    @NathanTuggy, not that I can see directly. I asked a question on Stackoverflow stackoverflow.com/questions/33756121/… With the dynamic nature of Stack Exchange, this may be possible. (Again I am not a jQuery expert)
    – rjdkolb
    Nov 20, 2015 at 7:01
  • 4

0

Browse other questions tagged .