Security Advisories (11)
CVE-2018-14041 (2018-07-13)

In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy.

CVE-2018-14042 (2018-07-13)

In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.

CVE-2020-11022 (2020-04-29)

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

CVE-2020-11023 (2020-04-29)

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

CVE-2019-11358 (2019-04-20)

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.

CVE-2015-9251 (2018-01-18)

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

CVE-2011-4969 (2013-03-08)

Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.

CVE-2012-6708 (2018-01-18)

jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.

CVE-2020-7656 (2020-05-19)

jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.

CVE-2019-5428

Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as _proto_, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.

CVE-2014-6071 (2018-01-16)

jQuery 1.4.2 allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to use of the text method inside after.

NAME

UR::Object::Property - Class representing metadata about a class property

SYNOPSIS

my $prop = UR::Object::Property->get(class_name => 'Some::Class', property_name => 'foo');

my $class_meta = Some::Class->__meta__;
my $prop2 = $class_meta->property_meta_for_name('foo');

# Print out the meta-property name and its value of $prop2
print map { " $_ : ".$prop2->$_ }
      qw(class_name property_name data_type default_value);

DESCRIPTION

Instances of this class represent properties of classes. For every item mentioned in the 'has' or 'id_by' section of a class definition become Property objects.

INHERITANCE

UR::Object::Property is a subclass of UR::Object

PROPERTY TYPES

For this class definition: class Some::Class { has => [ other_id => { is => 'Text' }, other => { is => 'Some::Other', id_by => 'foo_id' }, bar => { via => 'other', to => 'bar' }, foos => { is => 'Some::Foo', reverse_as => 'some', is_many => 1 }, uc_other_id => { calculate_from => 'other_id', calculate_perl => 'uc($other_id)' }, ], };

Properties generally fall in to one of these categories:

regular property

A regular property of a class holds a single scalar. In this case, 'other_id' is a regular property.

object accessor

An object accessor property returns objects of some class. The properties of this class must link in some way with all the ID properties of the remote class (the 'is' declaration). 'other' is an object accessor property. This is how one-to-one relationships are implemented.

via property

When a class has some object accessor property, and it is helpful for an object to assume the value of the remote class's properties, you can set up a 'via' property. In the example above, an object of this class gets the value of its 'bar' property via the 'other' object it's linked to, from that object's 'bar' property.

reverse as or is many property

This is how one-to-many relationships are implemented. In this case, the Some::Foo class must have an object accessor property called 'some', and the 'foos' property will return a list of all the Some::Foo objects where their 'some' property would have returned that object.

calculated property

A calculated property doesn't store its data directly in the object, but when its accessor is called, the calculation code is executed.

PROPERTIES

Each property has a method of the same name

Direct Properties

class_name => Text

The name of the class this Property is attached to

property_name => Text

The name of the property. The pair of class_name and property name are the ID properties of UR::Object::Property

column_name => Text

If the class is backed by a database table, then the column this property's data comes from is stored here

data_type => Text

The type of data stored in this property. Corresponds to the 'is' part of a class's property definition.

data_length => Number

The maximum size of data stored in this property

default_value

For is_optional properties, the default value given when an object is created and this property is not assigned a value.

valid_values => ARRAY

A listref of enumerated values this property may be set to

doc => Text

A place for documentation about this property

is_id => Boolean

Indicates whether this is an ID property of the class

is_optional => Boolean

Indicates whether this is property may have the value undef when the object is created

is_transient => Boolean

Indicates whether this is property is transient?

is_constant => Boolean

Indicates whether this property can be changed after the object is created.

is_mutable => Boolean

Indicates this property can be changed via its accessor. Properties cannot be both constant and mutable

is_volatile => Boolean

Indicates this property can be changed by a mechanism other than its normal accessor method. Signals are not emitted even when it does change via its normal accessor method.

is_classwide => Boolean

Indicates this property's storage is shared among all instances of the class. When the value is changed for one instance, that change is effective for all instances.

is_delegated => Boolean

Indicates that the value for this property is not stored in the object directly, but is delegated to another object or class.

is_calculated => Boolean

Indicates that the value for this property is not a part of the object'd data directly, but is calculated in some way.

is_transactional => Boolean

Indicates the changes to the value of this property is tracked by a Context's transaction and can be rolled back if necessary.

is_abstract => Boolean

Indicates this property exists in a base class, but must be overridden in a derived class.

is_concrete => Boolean

Antonym for is_abstract. Properties cannot be both is_abstract and is_concrete,

is_final => Boolean

Indicates this property cannot be overridden in a derived class.

is_deprecated => Boolean

Indicates this property's use is deprecated. It has no effect in the use of the property in any way, but is useful in documentation.

implied_by => Text

If this property is created as a result of another property's existence, implied_by is the name of that other property. This can happen in the case where an object accessor property is defined

has => [ 
    foo => { is => 'Some::Other', id_by => 'foo_id' },
],

Here, the 'foo' property requires another property called 'foo_id', which is not explicitly declared. In this case, the Property named foo_id will have its implied_by set to 'foo'.

id_by => ARRAY

In the case of an object accessor property, this is the list of properties in this class that link to the ID properties in the remote class.

reverse_as => Text

Defines the linking property name in the remote class in the case of an is_many relationship

via => Text

For a via-type property, indicates which object accessor to go through.

to => Text

For a via-type property, indicates the property name in the remote class to get its value from. The default value is the same as property_name

where => ARRAY

Supplies additional filters for indirect properties. For example:

foos => { is => 'Some::Foo', reverse_as => 'some', is_many => 1 },
blue_foos => { via => 'foos', where => [ color => 'blue' ] },

Would create a property 'blue_foos' which returns only the related Some::Foo objects that have 'blue' color.

calculate_from => ARRAY

For calculated properties, this is a list of other property names the calculation is based on

calculate_perl => Text

For calculated properties, a string containing Perl code. Any properties mentioned in calculate_from will exist in the code's scope at run time as scalars of the same name.

class_meta => UR::Object::Type

Returns the class metaobject of the class this property belongs to

METHODS

via_property_meta

For via/to delegated properties, return the property meta in the same class this property delegates through

to_property_meta

For via/to delegated properties, return the property meta on the foreign class that this property delegates to

SEE ALSO

UR::Object::Type, UR::Object::Type::Initializer, UR::Object