Update dependency jquery-rails to v4 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
jquery-rails	'3.0.4' → '4.4.0'

GitHub Vulnerability Alerts

CVE-2015-1840

jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.

CVE-2020-11023

Impact

Passing HTML containing <option> elements from untrusted sources - even after sanitizing them - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.

Patches

This problem is patched in jQuery 3.5.0.

Workarounds

To workaround this issue without upgrading, use DOMPurify with its SAFE_FOR_JQUERY option to sanitize the HTML string before passing it to a jQuery method.

References

https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery repo. If you don't find an answer, open a new issue.

CVE-2019-11358

jQuery from 1.1.4 until 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.

CVE-2015-9251

Affected versions of jquery interpret text/javascript responses from cross-origin ajax requests, and automatically execute the contents in jQuery.globalEval, even when the ajax request doesn't contain the dataType option.

Recommendation

Update to version 3.0.0 or later.

CVE-2020-11022

Impact

Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.

Patches

This problem is patched in jQuery 3.5.0.

Workarounds

To workaround the issue without upgrading, adding the following to your code:

jQuery.htmlPrefilter = function( html ) {
	return html;
};

You need to use at least jQuery 1.12/2.2 or newer to be able to apply this workaround.

References

https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/
https://jquery.com/upgrade-guide/3.5/

For more information

If you have any questions or comments about this advisory, search for a relevant issue in the jQuery repo. If you don't find an answer, open a new issue.

---

Release Notes

rails/jquery-rails (jquery-rails)

v4.4.0

Compare Source

• update jquery to 3.5.1 (note: 3.5.0 contains important security updates)
• unescape dollar signs and backticks in assert_select_jquery to match
  Rails updated behavior.

v4.3.5

Compare Source

• update jquery to 3.4.1

v4.3.4

Compare Source

• update jquery to 3.4.0

v4.3.3

Compare Source

• update jquery to 3.3.1

v4.3.2

Compare Source

• update jquery to 3.3.0
• Add possibility to test HTML: all, attribute prefix, attribute contains,
  attribute ends with, child, and class selectors
• Fix matching multiple calls for the same selector/function exception

v4.3.1

Compare Source

• update jquery to 3.2.1

v4.3.0

Compare Source

• update jquery to 3.2.0
• Add possibility to test HTML attribute selectors

v4.2.2

Compare Source

• update jquery to 3.1.1

v4.2.1

Compare Source

• update jquery to 3.1.0

v4.2.0

Compare Source

• Support jQuery 3.x
• Update jquery-ujs to 1.2.2
• Update jQuery to 1.12.4 and 2.2.4

v4.1.1

Compare Source

• Update jQuery to 1.12.1 and 2.2.1
• Update jquery-ujs to 1.2.1

v4.1.0

Compare Source

• Update jQuery to 1.12.0 and 2.2.0
• Update jquery-ujs to 1.2.0

v4.0.5

Compare Source

• Specify that Ruby version 1.9.3+ is required
• Test on Ruby 2.2
• Update jquery-ujs from 1.0.4 to 1.1.0

v4.0.4

Compare Source

• Fix CSP bypass vulnerability. CVE-2015-1840

v4.0.3

Compare Source

v4.0.2

Compare Source

v4.0.1

Compare Source

• Fix RubyGems permission problem.

v4.0.0

Compare Source

• Minimum dependency set to Rails 4.2
  • Updated to jquery-ujs 1.0.2
  • Support jQuery 1.x and 2.x

v3.1.5

Compare Source

v3.1.4

Compare Source

v3.1.3

Compare Source

• Fix CSP bypass vulnerability. CVE-2015-1840

v3.1.2

Compare Source

• Updated to jquery-ujs 1.0.1

v3.1.1

Compare Source

• Updated to jQuery 1.11.1
  • Updated to jquery-ujs 1.0.0

v3.1.0

Compare Source

• Updated to jQuery 1.11.0
  • Updated to latest jquery-ujs
  • Added development rake task for updating jQuery

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: Gemfile.lock

[11:57:20.864] INFO (1768): Installing tool ruby@2.1.0...
/usr/local/containerbase/tools/v2/ruby.sh: line 79: /etc/gemrc: Permission denied
[11:57:21.605] ERROR (1768): Command failed with exit code 1: bash /usr/local/containerbase/bin/v2-install-tool.sh install ruby 2.1.0
[11:57:21.605] FATAL (1768): Install tool ruby failed in 750ms.