diff --git a/.gitignore b/.gitignore index 7128954..d9fb1c7 100644 --- a/.gitignore +++ b/.gitignore @@ -1,17 +1,3 @@ -*.swp -jquery-*/* /js-jquery-4dec426aa2a6cbabb1b064319ba7c272d594a688.tar.gz /js-jquery-8f2a9d9272d6ed7f32d3a484740ab342c02541e0.tar.gz /jquery-2.2.4.tar.gz -/jquery-3.2.1.tar.gz -/jquery-3.3.1.tar.gz -/jquery-3.5.0.tar.gz -/jquery_3.5.0_node_modules.tar.gz -/jquery-3.6.0.tar.gz -/jquery_3.6.0_node_modules.tar.gz -/jquery-3.6.3.tar.gz -/jquery_3.6.3_node_modules.tar.gz -/jquery-3.6.4.tar.gz -/jquery_3.6.4_node_modules.tar.gz -/jquery-3.7.1.tar.gz -/jquery_3.7.1_node_modules.tar.gz diff --git a/js-jquery-disable-gzip-js.patch b/js-jquery-disable-gzip-js.patch index 0b28b43..9bf8ecd 100644 --- a/js-jquery-disable-gzip-js.patch +++ b/js-jquery-disable-gzip-js.patch @@ -1,11 +1,11 @@ -diff -up jquery-3.7.1/Gruntfile.js.gzip jquery-3.7.1/Gruntfile.js ---- jquery-3.7.1/Gruntfile.js.gzip 2023-08-28 07:37:56.000000000 -0600 -+++ jquery-3.7.1/Gruntfile.js 2023-09-01 18:36:58.570497362 -0600 -@@ -14,7 +14,6 @@ module.exports = function( grunt ) { +diff --git a/Gruntfile.js b/Gruntfile.js +--- a/Gruntfile.js ++++ b/Gruntfile.js +@@ -13,7 +13,6 @@ module.exports = function( grunt ) { + + var fs = require( "fs" ), + stripJSONComments = require( "strip-json-comments" ), +- gzip = require( "gzip-js" ), + srcHintOptions = readOptionalJSON( "src/.jshintrc" ), + newNode = !/^v0/.test( process.version ), - const fs = require( "fs" ); - const { spawn } = require( "child_process" ); -- const gzip = require( "gzip-js" ); - const nodeV16OrNewer = !/^v1[0-5]\./.test( process.version ); - const nodeV17OrNewer = !/^v1[0-6]\./.test( process.version ); - const customBrowsers = process.env.BROWSERS && process.env.BROWSERS.split( "," ); diff --git a/js-jquery.spec b/js-jquery.spec index 86cb6e5..b505182 100644 --- a/js-jquery.spec +++ b/js-jquery.spec @@ -1,6 +1,6 @@ Name: js-jquery -Version: 3.7.1 -Release: 7%{?dist} +Version: 2.2.4 +Release: 3%{?dist} Summary: JavaScript DOM manipulation, event handling, and AJAX library BuildArch: noarch @@ -8,56 +8,63 @@ BuildArch: noarch %global ver_y %(echo %{version} | cut -d. -f2) %global ver_z %(echo %{version} | cut -d. -f3) -License: MIT +License: MIT URL: https://jquery.com/ Source0: https://github.com/jquery/jquery/archive/%{version}/jquery-%{version}.tar.gz -# Created by ./update-sources.sh -Source1: jquery_%{version}_node_modules.tar.gz # disable gzip-js during build Patch1: %{name}-disable-gzip-js.patch - +# backport of XSS bug fix from upstream; upstream fixed in 3.0.0 and newer +Patch2: xss-fix-b078a62.patch BuildRequires: web-assets-devel BuildRequires: nodejs-packaging -BuildRequires: nodejs +BuildRequires: js-sizzle-static Provides: jquery = %{version}-%{release} Provides: %{name}-static = %{version}-%{release} -Provides: %{name}%{ver_x} = %{version}-%{release} -Provides: %{name}%{ver_x}-static = %{version}-%{release} +Provides: %{name}2 = %{version}-%{release} +Provides: %{name}2-static = %{version}-%{release} + +BuildRequires: nodejs-grunt >= 0.4.4-3 +BuildRequires: npm(shelljs) +BuildRequires: npm(grunt-cli) +BuildRequires: npm(grunt-contrib-uglify) +BuildRequires: npm(load-grunt-tasks) +BuildRequires: npm(requirejs) +#BuildRequires: npm(strip-json-comments) # won't work on epel7 branch +BuildRequires: nodejs-strip-json-comments Requires: web-assets-filesystem -# Bundles sizzle (https://github.com/jquery/sizzle/) in node_modules/sizzle -# Get version from package.json -Provides: bundled(sizzle) = 2.3.5 -Provides: bundled(js-sizzle) = 2.3.5 - - %description jQuery is a fast, small, and feature-rich JavaScript library. It makes things -like HTML document traversal and manipulation, event handling, animation, and -Ajax much simpler with an easy-to-use API that works across a multitude of -browsers. With a combination of versatility and extensibility, jQuery has +like HTML document traversal and manipulation, event handling, animation, and +Ajax much simpler with an easy-to-use API that works across a multitude of +browsers. With a combination of versatility and extensibility, jQuery has changed the way that millions of people write JavaScript. %prep -%autosetup -n jquery-%{version} -v -p1 +# autosetup doesn't work right on epel7 branch +%setup -qn jquery-%{version} +%patch1 -p1 +%patch2 -p1 #remove precompiled stuff -rm -rf dist/* +rm -rf dist/* src/sizzle -# Install the cached node modules -tar xf %{SOURCE1} +#put sizzle where jquery expects it +install -Dp %{_jsdir}/sizzle/latest/sizzle.js src/sizzle/dist/sizzle.js %build -./node_modules/grunt-cli/bin/grunt -v 'build:*:*' uglify +%nodejs_symlink_deps --build +grunt -v 'build:*:*' uglify -%check -./node_modules/grunt-cli/bin/grunt -v 'build:*:*' test:prepare test:fast +# missing dependencies +#%%check +#grunt %install @@ -81,93 +88,6 @@ ln -s %{version} %{installdir}/%{ver_x}.%{ver_y} %changelog -* Tue Nov 11 2025 Tomas Juhasz - 3.7.1-7 -- Rebuilt for nodejs-packaging - -* Thu Jul 24 2025 Fedora Release Engineering - 3.7.1-6 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - -* Fri Jan 17 2025 Fedora Release Engineering - 3.7.1-5 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild - -* Thu Jul 18 2024 Fedora Release Engineering - 3.7.1-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - -* Wed Jan 24 2024 Fedora Release Engineering - 3.7.1-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Sat Jan 20 2024 Fedora Release Engineering - 3.7.1-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Sat Sep 02 2023 Orion Poplawski - 3.7.1-1 -- Update to 3.7.1 - -* Thu Jul 20 2023 Fedora Release Engineering - 3.6.4-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - -* Thu Mar 09 2023 Orion Poplawski - 3.6.4-1 -- Update to 3.6.4 - -* Thu Jan 19 2023 Fedora Release Engineering - 3.6.3-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - -* Thu Dec 22 2022 Orion Poplawski - 3.6.3-1 -- Update to 3.6.3 - -* Thu Jul 21 2022 Fedora Release Engineering - 3.6.0-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - -* Thu Jan 20 2022 Fedora Release Engineering - 3.6.0-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - -* Mon Jan 17 2022 Orion Poplawski - 3.6.0-1 -- Update to 3.6.0 - -* Thu Jul 22 2021 Fedora Release Engineering - 3.5.0-6 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - -* Tue Jan 26 2021 Fedora Release Engineering - 3.5.0-5 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - -* Tue Jul 28 2020 Fedora Release Engineering - 3.5.0-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - -* Fri Apr 17 2020 Stephen Gallagher - 3.5.0-3 -- Add explicit dependency on nodejs - -* Wed Apr 15 2020 Stephen Gallagher - 3.5.0-2 -- Add virtual Provides: for bundled sizzle - -* Mon Apr 13 2020 Stephen Gallagher - 3.5.0-1 -- Update to 3.5.0 -- Bundle the build dependencies in the source RPM -- Drop unneeded patches - -* Wed Jan 29 2020 Fedora Release Engineering - 3.3.1-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - -* Thu Jul 25 2019 Fedora Release Engineering - 3.3.1-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild - -* Fri Feb 01 2019 Fedora Release Engineering - 3.3.1-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild - -* Wed Jul 18 2018 Christopher Tubbs - 3.3.1-1 -- Update to 3.3.1; fixes rhbz#1536772 rhbz#1445079 rhbz#1591846 Security fix for - CVE-2012-6708 - -* Fri Jul 13 2018 Fedora Release Engineering - 3.2.1-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild - -* Wed Feb 07 2018 Fedora Release Engineering - 3.2.1-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild - -* Wed Jul 26 2017 Fedora Release Engineering - 3.2.1-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild - -* Wed Apr 12 2017 Christopher Tubbs - 3.2.1-1 -- Update to jQuery 3.2.1 - * Tue Apr 11 2017 Christopher Tubbs - 2.2.4-3 - Update provides in prep for js-jquery package rename to js-jquery2 diff --git a/sources b/sources index 1c4281a..1aee121 100644 --- a/sources +++ b/sources @@ -1,2 +1 @@ -SHA512 (jquery-3.7.1.tar.gz) = 693a7e70ef70e48742cb98ecfc48e156356d262261c8c457d289172a953dd57f471db827658f9ceb4000eeef069b0c4b14ec453543a5c41b44a95b5865df6643 -SHA512 (jquery_3.7.1_node_modules.tar.gz) = f2bcfd131e4966bdf81321a61cf4b71820fb09fc336f6084a2643afa95e84637b3ae7bd01b735a8e81ba1bfc39b128902c44e620bda46ad68e82626d36fd6865 +SHA512 (jquery-2.2.4.tar.gz) = bd1176286451adeaa8c18eb98e01e8b91e45157f7263907772d637a2c15b8ac27b780be14983c4abcff5def668323beab9a6889d8da4beb6c2c06fae1f5bed1d diff --git a/update-sources.sh b/update-sources.sh deleted file mode 100755 index f8eba2a..0000000 --- a/update-sources.sh +++ /dev/null @@ -1,118 +0,0 @@ -#!/bin/bash -e - -# Created by argbash-init v2.8.1 -# ARG_POSITIONAL_SINGLE([version]) -# ARG_DEFAULTS_POS() -# ARG_HELP([Download and cache all build dependencies for jquery]) -# ARGBASH_GO() -# needed because of Argbash --> m4_ignore([ -### START OF CODE GENERATED BY Argbash v2.8.1 one line above ### -# Argbash is a bash code generator used to get arguments parsing right. -# Argbash is FREE SOFTWARE, see https://argbash.io for more info - - -die() -{ - local _ret=$2 - test -n "$_ret" || _ret=1 - test "$_PRINT_HELP" = yes && print_help >&2 - echo "$1" >&2 - exit ${_ret} -} - - -begins_with_short_option() -{ - local first_option all_short_options='h' - first_option="${1:0:1}" - test "$all_short_options" = "${all_short_options/$first_option/}" && return 1 || return 0 -} - -# THE DEFAULTS INITIALIZATION - POSITIONALS -_positionals=() -_arg_version= -# THE DEFAULTS INITIALIZATION - OPTIONALS - - -print_help() -{ - printf '%s\n' "Download and cache all build dependencies for jquery" - printf 'Usage: %s [-h|--help] \n' "$0" - printf '\t%s\n' "-h, --help: Prints help" -} - - -parse_commandline() -{ - _positionals_count=0 - while test $# -gt 0 - do - _key="$1" - case "$_key" in - -h|--help) - print_help - exit 0 - ;; - -h*) - print_help - exit 0 - ;; - *) - _last_positional="$1" - _positionals+=("$_last_positional") - _positionals_count=$((_positionals_count + 1)) - ;; - esac - shift - done -} - - -handle_passed_args_count() -{ - local _required_args_string="'version'" - test "${_positionals_count}" -ge 1 || _PRINT_HELP=yes die "FATAL ERROR: Not enough positional arguments - we require exactly 1 (namely: $_required_args_string), but got only ${_positionals_count}." 1 - test "${_positionals_count}" -le 1 || _PRINT_HELP=yes die "FATAL ERROR: There were spurious positional arguments --- we expect exactly 1 (namely: $_required_args_string), but got ${_positionals_count} (the last one was: '${_last_positional}')." 1 -} - - -assign_positional_args() -{ - local _positional_name _shift_for=$1 - _positional_names="_arg_version " - - shift "$_shift_for" - for _positional_name in ${_positional_names} - do - test $# -gt 0 || break - eval "$_positional_name=\${1}" || die "Error during argument parsing, possibly an Argbash bug." 1 - shift - done -} - -parse_commandline "$@" -handle_passed_args_count -assign_positional_args 1 "${_positionals[@]}" - -# OTHER STUFF GENERATED BY Argbash - -### END OF CODE GENERATED BY Argbash (sortof) ### ]) -# [ <-- needed because of Argbash - -version=$_arg_version -rm -rf jquery-$version jquery-$version.tar.gz jquery_${version}_node_modules.tar.gz -wget https://github.com/jquery/jquery/archive/$version/jquery-$version.tar.gz - -tar xf jquery-$version.tar.gz - -pushd jquery-$version -npm install --save-dev -tar cfz ../jquery_${version}_node_modules.tar.gz node_modules - -# Husky tries to install a git hook that doesn't play well with dist-git -npm uninstall husky -popd - -fedpkg new-sources jquery-$version.tar.gz jquery_${version}_node_modules.tar.gz - -# ] <-- needed because of Argbash diff --git a/xss-fix-b078a62.patch b/xss-fix-b078a62.patch new file mode 100644 index 0000000..8f730c1 --- /dev/null +++ b/xss-fix-b078a62.patch @@ -0,0 +1,91 @@ +From b078a62013782c7424a4a61a240c23c4c0b42614 Mon Sep 17 00:00:00 2001 +From: Oleg Gaidarenko +Date: Thu, 10 Sep 2015 13:40:00 +0300 +Subject: [PATCH] Ajax: Mitigate possible XSS vulnerability + +Proposed by @jaubourg + +Fixes gh-2432 +Closes gh-2588 +--- + src/ajax/script.js | 7 +++++++ + test/unit/ajax.js | 48 ++++++++++++++++++++++++++++++++++++++++++++++++ + 2 files changed, 55 insertions(+), 0 deletion(-) + +diff --git a/src/ajax/script.js b/src/ajax/script.js +index 60b1fb6..0ec27b4 100644 +--- a/src/ajax/script.js ++++ b/src/ajax/script.js +@@ -4,6 +4,13 @@ define( [ + "../ajax" + ], function( jQuery, document ) { + ++// Prevent auto-execution of scripts when no explicit dataType was provided (See gh-2432) ++jQuery.ajaxPrefilter( function( s ) { ++ if ( s.crossDomain ) { ++ s.contents.script = false; ++ } ++} ); ++ + // Install script dataType + jQuery.ajaxSetup( { + accepts: { +diff --git a/test/unit/ajax.js b/test/unit/ajax.js +index 14fe0be..6479587 100644 +--- a/test/unit/ajax.js ++++ b/test/unit/ajax.js +@@ -71,6 +71,54 @@ QUnit.module( "ajax", { + }; + } ); + ++ ajaxTest( "jQuery.ajax() - do not execute js (crossOrigin)", 2, function( assert ) { ++ return { ++ create: function( options ) { ++ options.crossDomain = true; ++ return jQuery.ajax( url( "data/script.php?header=ecma" ), options ); ++ }, ++ success: function() { ++ assert.ok( true, "success" ); ++ }, ++ complete: function() { ++ assert.ok( true, "complete" ); ++ } ++ }; ++ } ); ++ ++ ajaxTest( "jQuery.ajax() - execute js for crossOrigin when dataType option is provided", 3, ++ function( assert ) { ++ return { ++ create: function( options ) { ++ options.crossDomain = true; ++ options.dataType = "script"; ++ return jQuery.ajax( url( "data/script.php?header=ecma" ), options ); ++ }, ++ success: function() { ++ assert.ok( true, "success" ); ++ }, ++ complete: function() { ++ assert.ok( true, "complete" ); ++ } ++ }; ++ } ++ ); ++ ++ ajaxTest( "jQuery.ajax() - do not execute js (crossOrigin)", 2, function( assert ) { ++ return { ++ create: function( options ) { ++ options.crossDomain = true; ++ return jQuery.ajax( url( "data/script.php" ), options ); ++ }, ++ success: function() { ++ assert.ok( true, "success" ); ++ }, ++ complete: function() { ++ assert.ok( true, "complete" ); ++ } ++ }; ++ } ); ++ + ajaxTest( "jQuery.ajax() - success callbacks (late binding)", 8, function( assert ) { + return { + setup: addGlobalEvents( "ajaxStart ajaxStop ajaxSend ajaxComplete ajaxSuccess", assert ),