Microsoft.VisualStudio.Web.CodeGenerators.Mvc 2.2.3 ships vulnerable version of jQuery

[wasker]

Steps to reproduce:

1. Use Microsoft.VisualStudio.Web.CodeGenerators.Mvc 2.2.3 in a project covered by Azure Component Governance

Expected behavior:

Not have an alert from Component Governance

Actual behavior:

Receive alert as following:

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.

The vulnerability could be tracked down to Templates\Identity\wwwroot\lib\jquery\dist

[seancpeters]

@vijayrkn @danroth27

[seancpeters]

@mkArtakMSFT

[seancpeters]

@vijayrkn @danroth27 @mkArtakMSFT @HaoK - To fix this, we'll need to update the scaffolded content under wwwroot/ for identity scaffolding. I think we'd want to stay in sync with other identity content providers - you all would know more about the content than me.

[mkArtakMSFT]

We actually go through a bunch of dependency updates at the moment. @ryanbrandenburg is the jQuery dependency being updated too?

[mkArtakMSFT]

@HaoK are you handling the Identity UI updates?

[HaoK]

Sure but I haven't done this before, are we just updating the scaffolded files to jquery 3.4?

[seancpeters]

That should be all that's necessary - just the bootstrap3 files under the wwwroot dir, here:
https://github.com/aspnet/Scaffolding/tree/master/src/VS.Web.CG.Mvc/Templates/Identity/Bootstrap3/wwwroot
If the list of files to serve up changes, corresponding changes will need to be made in the config file here:
https://github.com/aspnet/Scaffolding/blob/master/src/VS.Web.CG.Mvc/Identity/bootstrap3_identitygeneratorfilesconfig.json
But if the file list remains the same, no changes will need to be made there.

[HaoK]

I updated bootstrap 3 and 4 since both seemed to be using jquery 3.3.1

[HaoK]

Merged

[vijayrkn]

@HaoK - Which branch was this merged? Is this a 3.0 change?

[HaoK]

It was merged back in Jun into master #1011

[vijayrkn]

Thanks!

[wasker]

@HaoK When is the next release going to be? The one on /releases is still from Feb.