Security vulnerability in jquery?

[mbojan]

I have received this email from GitHub:

[skyebend]

Thanks! I've been shamefully ignoring dependabot alerts, as I don't think this is exploitable in the way we use jquery, but I definitely need to try to update.

[mbojan]

I'll give it a shot with a little help of my friend.

[mbojan]

Plan: Upgrade jQuery 2.1.1 → 4.0.0

Background

jQuery 4.0.0 removed all APIs that had been deprecated in the 3.x series.
Compared to a 3.5.0 upgrade, the code in ndtv-d3.js requires one additional
fix ($.isNumeric) and one previously optional fix (the .resize() D3-
selection bug) becomes more urgent. Everything else in the codebase is
compatible as-is.

---

Step 1 — Replace the jQuery library files

Files to update:

• ndtv/inst/javascript/ndtv-d3/src/lib/jquery/dist/jquery.min.js
• ndtv/inst/javascript/ndtv-d3/src/lib/jquery/dist/jquery.min.map
• ndtv/inst/javascript/ndtv-d3/src/lib/jquery/MIT-LICENSE.txt

Download the jQuery 4.0.0 minified distribution from the official jQuery CDN
(https://code.jquery.com/jquery-4.0.0.min.js) and its sourcemap, replacing
the existing files in place. Update the LICENSE text accordingly.

---

Step 2 — Update the version declaration in the widget YAML

File: ndtv/inst/htmlwidgets/ndtvAnimationWidget.yaml, line 4

The htmlwidgets infrastructure uses this value to generate cache-busting
URLs; it must match the actual library file.

# Before
version: 2.1.1

# After
version: 4.0.0

---

Step 3 — Update the hardcoded remote CDN URL in the R source

File: ndtv/R/render.d3_animation.R, line 425

The remoteSrc script mode embeds a literal URL pointing to the old version
on Google's CDN. Also fix http → https to avoid mixed-content blocks in
modern browsers.

# Before
<script src='http://ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js'></script>

# After
<script src='https://ajax.googleapis.com/ajax/libs/jquery/4.0.0/jquery.min.js'></script>

Note: verify that Google's hosted libraries CDN carries jQuery 4.0.0 once it
is available there; if not, https://code.jquery.com/jquery-4.0.0.min.js is
the authoritative fallback.

---

Step 4 — Fix breaking API changes in ndtv-d3.js

All changes are in ndtv/inst/javascript/ndtv-d3/src/js/ndtv-d3.js.

4a — Fix D3 selection passed to $() for resize binding (lines 170–174)

domTarget is a D3 v3 selection object (array-like, not a DOM element).
jQuery 3 onwards is stricter about what it accepts and will not correctly bind
resize to such an object. Use .node() to extract the underlying DOM
element. The .resize(fn) shorthand was deprecated in jQuery 3.3 and, while
not yet removed in 4.0, should be replaced with .on() at the same time to
avoid a future hard break:

// Before
$(domTarget).resize(function(n) {
  n3.resizeGraph(n);
});
$(window).resize(function(n) {
  n3.resizeGraph(n);
});

// After
$(domTarget.node()).on('resize', function(n) {
  n3.resizeGraph(n);
});
$(window).on('resize', function(n) {
  n3.resizeGraph(n);
});

4b — Replace $.type() with typeof (line 564)

$.type() was deprecated in jQuery 3.0 and removed in jQuery 4.0. For a
simple string check, the native typeof operator is the direct replacement:

// Before
if (value && $.type(value) === 'string' && value.match('rgba')) {

// After
if (value && typeof value === 'string' && value.match('rgba')) {

4c — Replace $.isNumeric() with Number.isFinite() (line 710)

$.isNumeric() was deprecated in jQuery 3.3 and removed in jQuery 4.0.
This is the one breakage not present in a 3.5.0 upgrade. At this call site,
ratio is a computed floating-point value (hlen - offset) / hlen; the guard
is checking that it did not produce NaN or Infinity (e.g. when hlen is
zero). Number.isFinite() is the exact native equivalent for that intent:

// Before
if ($.isNumeric(ratio)) {

// After
if (Number.isFinite(ratio)) {

---

Step 5 — Verify $('body').prepend(svgString) calls (lines 333, 375)

jQuery 3.5.0 tightened HTML parsing in manipulation methods as a security fix,
and jQuery 4.0 retains those restrictions. The two $('body').prepend(...)
calls inject SVG icon sprite strings. These strings do not contain
<script> tags or self-closing non-void HTML elements, so they are unaffected.
No code change is needed, but these should be verified manually in a browser
after the upgrade.

---

APIs confirmed still present in jQuery 4.0 (no action needed)

The following jQuery utility functions are used in ndtv-d3.js and were
not removed in 4.0:

API	Used at lines
$.extend()	135, 138, 139, 615
$.each()	317, 428, 439, 450, 522, 532, 544, 585, 618, 638, 639, 859, 911, 917
$.isPlainObject()	420, 496
$.isEmptyObject()	429, 440
$.get() / $.getJSON()	310, 499
.on(), .val(), .attr()	various
.offset(), .outerHeight()	234, 295
.fadeToggle(), .toggleClass()	364, 365
.append(), .prepend()	333, 375, 884
.parent(), .scrollLeft(), .scrollTop()	882, 1318, 1319

---

Summary

#	File	Change
1	ndtv/inst/javascript/ndtv-d3/src/lib/jquery/dist/jquery.min.js	Replace with jQuery 4.0.0
1	ndtv/inst/javascript/ndtv-d3/src/lib/jquery/dist/jquery.min.map	Replace with jQuery 4.0.0 sourcemap
1	ndtv/inst/javascript/ndtv-d3/src/lib/jquery/MIT-LICENSE.txt	Update license text
2	ndtv/inst/htmlwidgets/ndtvAnimationWidget.yaml	version: 2.1.1 → version: 4.0.0
3	ndtv/R/render.d3_animation.R line 425	Update CDN URL and fix http → https
4a	ndtv/inst/javascript/ndtv-d3/src/js/ndtv-d3.js lines 170–174	$(domTarget).resize(fn) → $(domTarget.node()).on('resize', fn); same for $(window)
4b	ndtv/inst/javascript/ndtv-d3/src/js/ndtv-d3.js line 564	$.type(value) === 'string' → typeof value === 'string'
4c	ndtv/inst/javascript/ndtv-d3/src/js/ndtv-d3.js line 710	$.isNumeric(ratio) → Number.isFinite(ratio) (new vs 3.5.0 plan)