Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: bump jquery-ui to v1.13.2 to fix multiple CVEs #2477

Merged
merged 8 commits into from
May 23, 2023
Merged

fix: bump jquery-ui to v1.13.2 to fix multiple CVEs #2477

merged 8 commits into from
May 23, 2023

Conversation

daschnerm
Copy link
Contributor

@daschnerm daschnerm commented Apr 21, 2023 •
edited
Loading

What

  • bump jquery-ui to v1.13.2 to fix CVE-2016-7103
  • I've tested the floating ToC, as well as the normal ToC feature still works without any issues.

Why

#2405

@cderv cderv linked an issue Apr 21, 2023 that may be closed by this pull request
Update jquery-ui to latest version to mitigate vulnerabilities #2405
Closed
@cderv cderv added the next to consider for next release label Apr 21, 2023
cderv
cderv reviewed Apr 21, 2023
View reviewed changes
Copy link
Collaborator

@cderv cderv left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks a lot.

I left a comment. I wonder if we should have exactly the same component.

Otherwise, I was wondering if we should sync with the version in shiny. What do you think ?
I did compare with this script executed on your branch

# This script aims to update and sync jquery-ui dependency with the one in shiny

rmd <- "inst/rmd/h/jqueryui/"

shiny <- "https://github.com/rstudio/shiny/archive/refs/heads/main.zip"

temp_zip <- tempfile(fileext = ".zip")
xfun::download_file(shiny, temp_zip, mode = "wb")

dir.create(temp_shiny <- tempfile("shiny"))

unzip(temp_zip, exdir = temp_shiny)

jqueryui <- file.path(temp_shiny, "shiny-main", "inst", "www", "shared", "jqueryui")

unlink(rmd, recursive = TRUE)

file.copy(jqueryui, dirname(rmd), overwrite = TRUE, recursive = TRUE)

unlink(temp_shiny, recursive = TRUE)
unlink(temp_zip, recursive = TRUE)

It seems there are some differences probably due to the components includes.

inst/rmd/h/jqueryui/jquery-ui.css Outdated Show resolved Hide resolved
@daschnerm
Copy link
Contributor Author

daschnerm commented Apr 24, 2023 •
edited
Loading

This is the diff between jquery-ui components in shiny and r-markdown:

diff shiny-js-sorted.txt rmarkdown-js-sorted.txt 
0a1,2
> data.js
> disable-selection.js
21a24
> position.js
24a28
> widget.js
30d33
< widgets/datepicker.js

which matches with the description from README.md from r-markdown:

It includes all components except the datepicker, because it conflicts with
bootstrap-datepicker that is packaged with Shiny.

However, the conflict between bootstrap-datepicker and jquery-ui datepicker was resolved in rstudio/shiny#1374, which is why I guess shiny includes the datepicker from jquery-ui again.

@daschnerm
Copy link
Contributor Author

@cderv I've updated the PR and pulled in thejquery-ui version from Shiny.

cderv
cderv reviewed May 23, 2023
View reviewed changes
Copy link
Collaborator

@cderv cderv left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks you.

I'll add an updating script and merge

@cderv cderv merged commit 151de7e into rstudio:main May 23, 2023
jonathan-g added a commit to jonathan-g/rmarkdown that referenced this pull request Aug 16, 2023
@jonathan-g
Merge remote-tracking branch 'rstudio/main' into jg-tree-fix
456765a 
* rstudio/main:
  start the next version
  CRAN release v2.24
  shinyrmd: Safer dependency extraction from pre-rendered HTML (rstudio#2500)
  quote the version number per CRAN's request
  Add output_format_dependency() (rstudio#2462)
  file_scope is now correctly merged when creating output_format (rstudio#2488)
  Correctly run some tests only on CI
  start the next version
  CRAN release v2.23
  remove broken links
  suggest cleanrmd for e499bf7
  add news
  comparing version numbers with numbers is no longer allowed: https://bugs.r-project.org/show_bug.cgi?id=18548
  `find_external_resources` works with custom format using `theme` (rstudio#2494)
  start the next version
  CRAN release v2.22
  S3 generic/method consistency
  Change the code-folding button text from "Code" to "Show" (rstudio#2489)
  fix: bump jquery-ui to v1.13.2 to fix multiple CVEs (rstudio#2477)
  detecting external resources needs to consider css argument (rstudio#2486)
jonathan-g added a commit to jonathan-g/rmarkdown that referenced this pull request Aug 16, 2023
@jonathan-g
Updated with RStudio version 2.24.1.
7f5f291 
Merge remote-tracking branch 'rstudio/main' into jg-devel

# By Yihui Xie (13) and others
# Via Yihui Xie
* rstudio/main:
  start the next version
  CRAN release v2.24
  shinyrmd: Safer dependency extraction from pre-rendered HTML (rstudio#2500)
  quote the version number per CRAN's request
  Add output_format_dependency() (rstudio#2462)
  file_scope is now correctly merged when creating output_format (rstudio#2488)
  Correctly run some tests only on CI
  start the next version
  CRAN release v2.23
  remove broken links
  suggest cleanrmd for e499bf7
  add news
  comparing version numbers with numbers is no longer allowed: https://bugs.r-project.org/show_bug.cgi?id=18548
  `find_external_resources` works with custom format using `theme` (rstudio#2494)
  start the next version
  CRAN release v2.22
  S3 generic/method consistency
  Change the code-folding button text from "Code" to "Show" (rstudio#2489)
  fix: bump jquery-ui to v1.13.2 to fix multiple CVEs (rstudio#2477)
  detecting external resources needs to consider css argument (rstudio#2486)

# Conflicts:
#	DESCRIPTION
jonathan-g added a commit to jonathan-g/rmarkdown that referenced this pull request Aug 16, 2023
@jonathan-g
Merge branch 'jg-devel'
5079b46 
* jg-devel: (21 commits)
  Updated NEWS. Patched `merge_output_format_dependency` to ensure that named elements remain in the correct order.
  start the next version
  CRAN release v2.24
  shinyrmd: Safer dependency extraction from pre-rendered HTML (rstudio#2500)
  quote the version number per CRAN's request
  Add output_format_dependency() (rstudio#2462)
  file_scope is now correctly merged when creating output_format (rstudio#2488)
  Correctly run some tests only on CI
  start the next version
  CRAN release v2.23
  remove broken links
  suggest cleanrmd for e499bf7
  add news
  comparing version numbers with numbers is no longer allowed: https://bugs.r-project.org/show_bug.cgi?id=18548
  `find_external_resources` works with custom format using `theme` (rstudio#2494)
  start the next version
  CRAN release v2.22
  S3 generic/method consistency
  Change the code-folding button text from "Code" to "Show" (rstudio#2489)
  fix: bump jquery-ui to v1.13.2 to fix multiple CVEs (rstudio#2477)
  ...
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Nov 22, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers

@cderv cderv cderv approved these changes

Assignees
No one assigned
Labels
next to consider for next release
Projects
R Markdown Team Projects
Archived in project
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Update jquery-ui to latest version to mitigate vulnerabilities
2 participants
@daschnerm @cderv