-
-
Notifications
You must be signed in to change notification settings - Fork 53
Labels
C: websiteThis issue pertains to the official Qubes OS website.This issue pertains to the official Qubes OS website.P: defaultPriority: default. Default priority for new issues, to be replaced given sufficient information.Priority: default. Default priority for new issues, to be replaced given sufficient information.diagnosedTechnical diagnosis of this issue has been performed.Technical diagnosis of this issue has been performed.help wantedThis issue will probably not get done in a timely fashion without help from community contributors.This issue will probably not get done in a timely fashion without help from community contributors.pr submittedA pull request has been submitted for this issue.A pull request has been submitted for this issue.
Description
Brief summary
- The Qubes website was using
jquery-2.2.2.min.js. - GitHub's automated "Dependabot" created this alert: Potential XSS vulnerability in jQuery.
- In an attempt to fix it, I upgraded to
jquery-3.6.4.min.js(QubesOS/qubesos.github.io@b494ccd). - However, this broke the hamburger menu (the menu that replaces the nav bar on small screens).
- So I reverted my commit, and the website is back to using
jquery-2.2.2.min.js(QubesOS/qubesos.github.io@9a710a0).
Unfortunately, I'm not a professional web developer and don't really know how to fix the hamburger menu so that it's compatible with newer, non-vulnerable version of jQuery. I also don't know how serious this vuln is for us in our specific use case. Our site is mostly static and doesn't handle any sensitive user data. We also have this explicit warning: FAQ: Should I trust this website? Nonetheless, if it presents a significant risk for users, I'd rather let the hamburger menu be temporarily broken until someone with the requisite expertise can fix it.
Metadata
Metadata
Assignees
Labels
C: websiteThis issue pertains to the official Qubes OS website.This issue pertains to the official Qubes OS website.P: defaultPriority: default. Default priority for new issues, to be replaced given sufficient information.Priority: default. Default priority for new issues, to be replaced given sufficient information.diagnosedTechnical diagnosis of this issue has been performed.Technical diagnosis of this issue has been performed.help wantedThis issue will probably not get done in a timely fashion without help from community contributors.This issue will probably not get done in a timely fashion without help from community contributors.pr submittedA pull request has been submitted for this issue.A pull request has been submitted for this issue.