Skip to content

Qubes website uses a vulnerable version of jQuery, but patched version breaks menu #8186

@andrewdavidwong

Description

@andrewdavidwong

How to file a helpful issue

Brief summary

  1. The Qubes website was using jquery-2.2.2.min.js.
  2. GitHub's automated "Dependabot" created this alert: Potential XSS vulnerability in jQuery.
  3. In an attempt to fix it, I upgraded to jquery-3.6.4.min.js (QubesOS/qubesos.github.io@b494ccd).
  4. However, this broke the hamburger menu (the menu that replaces the nav bar on small screens).
  5. So I reverted my commit, and the website is back to using jquery-2.2.2.min.js (QubesOS/qubesos.github.io@9a710a0).

Unfortunately, I'm not a professional web developer and don't really know how to fix the hamburger menu so that it's compatible with newer, non-vulnerable version of jQuery. I also don't know how serious this vuln is for us in our specific use case. Our site is mostly static and doesn't handle any sensitive user data. We also have this explicit warning: FAQ: Should I trust this website? Nonetheless, if it presents a significant risk for users, I'd rather let the hamburger menu be temporarily broken until someone with the requisite expertise can fix it.

Metadata

Metadata

Assignees

No one assigned

    Labels

    C: websiteThis issue pertains to the official Qubes OS website.P: defaultPriority: default. Default priority for new issues, to be replaced given sufficient information.diagnosedTechnical diagnosis of this issue has been performed.help wantedThis issue will probably not get done in a timely fashion without help from community contributors.pr submittedA pull request has been submitted for this issue.

    Type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions