Security Advisories (9)
CVE-2020-11022 (2020-04-29)

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

CVE-2020-11023 (2020-04-29)

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

CVE-2019-11358 (2019-04-20)

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.

CVE-2015-9251 (2018-01-18)

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

CVE-2011-4969 (2013-03-08)

Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.

CVE-2012-6708 (2018-01-18)

jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.

CVE-2020-7656 (2020-05-19)

jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.

CVE-2019-5428

Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as _proto_, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.

CVE-2014-6071 (2018-01-16)

jQuery 1.4.2 allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to use of the text method inside after.

Name

YOTE

Summary

Yote is a platform for creating web based applications by bridging client side javascript with server side, automatically persistent perl objects. Yote provides javascript objects with methods that map to their server side counterparts.

See http://fenowyn.com/yote for more information.

Quickstart for OSX / Linux

In the following directions, $SITE_ROOT is the document root of your web site and $YOTE_ROOT is the directory where the Yote Build.PL file resides.

It's as easy as...

1. Ensure you have a web server that will serve CGIs
2. Install stuff and start the server
$ ./install '/path/to/your/web/root' '/path/to/cgi-bin'
3. Write your own code (e.g. "hello world" app, website code, etc)

(Note that the yote_server is automatically started in the background in step 2. Be sure to kill this when you're done with it, or they will tend to pile up.)

Requirements

  • perl version 5.10

  • A webserver that can run perl cgi files

  • jquery (provided with this distribution, or from http://docs.jquery.com/Downloading_jQuery)

  • Some sort of server-side storage (MySQL or a writable file)

Install Yote

$ perl Build.PL
$ ./Build
$ ./Build test
$ ./Build install

Verify / install the requirements

Following is how to verify that you have each of the requirements and, if not, to get it.

  • perl version 5.10

    To verify if you have this:

    $ perl -v

    If your version is too low, look at using perlbrew to upgrade:

    http://search.cpan.org/~gugod/App-perlbrew-0.39/bin/perlbrew

    (From the perlbrew docs:)

    $ curl -kL http://install.perlbrew.pl | bash
    $ ~/perl5/perlbrew/bin/perlbrew install 5.14.2  # Current version as of 2012-01-20
    $ ~/perl5/perlbrew/bin/perlbrew use 5.14.2
    $ perl -v  # Should now tell you 5.14.2

    This installs the perlbrew executable, the perl-5.14.2 executable, and all core Perl modules into ~/perl5/perlbrew/. It then sets the current shell to use the new version.

    You may also want to use cpanm (or another CPAN shell) to install additional modules for the new perl version.

  • Storage

    Yote needs to store data server side. This can be in a MySQL database or a file (which will become a SQLite database). Other options, including MongoDB, are in the works -- patches welcome!

    If you want MySQL storage, verify / install as follows:

    OSX has MySQL installed by default. Verify that it's running by doing:

    $ mysql -u root

    (NOTE: For simplicity, the directions in this README connect to MySQL as 'root'. This will work and it makes these directions easier, but in general practice you should connect via a user with lower permissions.)

    Many Linux distributions come with MySQL. If it is not installed and running by default, install it as per http://dev.mysql.com/doc/refman/5.5/en/installing.html (v5.5.x is latest as of 2012-01-20).

    Once MySQL is running, create a database for Yote to use and initialize it as follows:

    $ echo 'create database yote;' | mysql -u root
    $ script/init_datastore.pl 

    !!! @@DKSNOTE: init_datastore.pl is not included in the current version of Yote !!!

  • A webserver that can run perl cgi files

    OSX has Apache installed by default. To verify it is running and allow it to run CGIs, do the following:

      System Preferences > Sharing > Web Sharing 

    Ensure that the checkbox is checked; if so, the web server is up.

    By default, CGIs are served from /Library/WebServer/CGI-Executables/ (hereinafter '$CGI_BIN')

    By default, content is served from ~/Sites/ (hereinafter '$SITE_ROOT')

    On Linux, @@TODO

  • yote.cgi

    $ cp cgi/yote.cgi $CGI_BIN/
    $ chmod 755 $CGI_BIN/yote.cgi
  • jquery

    On OSX or Linux:

    $ mkdir -p $SITE_ROOT/js
    $ cp $YOTE_ROOT/javascript/* $SITE_ROOT/js
  • put the Yote::WebAppServer module in your path

    On OSX / Linux:

    $ export PERL5LIB=$YOTE_ROOT/lib:$PERL5LIB
  • modify the start_server.pl file

    !!! @@DKSNOTE: Can't find anything matching this name -- missing dependency? !!!

Using Yote

Start the Web App Server

Starting the Web App Server from the command line:

$ script/yote_server

This starts the server on the default port (8008), using SQLiteIO, and writing to file ~/.yote/SQLite.yote.db.

Starting the Web App Server from a package:

use Yote::WebAppServer;

my $server = new Yote::WebAppServer();

$server->start_server( port => 8008,
           datastore  => 'Yote::SQLiteIO',
           sqlitefile => 'yote.database' );

Coding with Yote

Client Side

<script src="./js/jquery-latest.js"></script>
<script src="./js/jquery.dumper.js"></script>
<script src="./js/jquery.base64.min.js"></script>
<script src="./js/json2.js"></script>
<script src="./js/yote.js"></script>
<script>
    var hello_app = $.gServ.get_app( 'Yote::Hello' );
    var result = hello_app.hello({ name:"fred" } );
    var counter = hello_app.get_counter();
</script>

Server Side

package Yote::Hello;

use strict;
use Yote::Obj;
use base 'Yote::AppRoot';

sub init {
    my $self = shift;
    my $counter = $self->get_counter( new Yote::Obj() );
}

sub hello {
    my( $self, $data, $acct ) = @_;
    my $name = $data->{name};
    my $counter = $self->get_counter();
    $counter->set_count( $counter->get_count() + 1 );
    return "hello there '$name'. I have said hello ". $counter->get_count() . " times.";
}

1;