Update jQuery or apply the fix?

[hrbrmstr]

GHSA-gxr4-xjj5-5px2

https://cve.circl.lu/cve/CVE-2020-11022

GHSA-gxr4-xjj5-5px2

https://twitter.com/hrbrmstr/status/1255796874877046784?s=20

[cpsievert]

jQuery.htmlPrefilter was added in jQuery 2.2.0 and html_document() is still on 1.11.3, so this vulnerability isn't currently relevant to rmarkdown.

It's worth noting that rmarkdown will soon upgrade to jQuery 3.x as a part of #1706 and it will do so via jquerylib which has already been upgraded to 3.5.0 on Github and a CRAN update will soon follow.

The current shiny release is on 3.4.1, so we'll soon have a new release with jQuery 3.x bumped to 3.5 (by the way, you can also use jQuery 1 today with options(shiny.jquery.version = 1)). However, I'd like to point out that the implications of the vulnerability seems small...shiny goes out of its way to make sure it doesn't treat user input directly as unescaped HTML. It's much more common of a situation that the shiny developer hasn't properly escaped user input in their R code, which something we can't manage for you.

This could, of course, still be an issue today if you have some other widget bringing in a vulnerable jQuery version. We'll do our part to make sure packages that we maintain (e.g., crosstalk) are up-to-date, but we can't necessarily control what 3rd party packages are doing. That concern should largely go away though once #1688 is done (implying that shiny and all html_document()s will be on >= 3.5.0).

[cpsievert]

(@yihui feel free to close this issue)

[apreshill]

@cderv I added the next label here (thanks @michaelquinn32) so we make sure this ends up in the next rmarkdown release.

[cderv]

Currently we need JQuery in rmarkdown in a few place specifically when using toc_float, or for tabsets, code folding and source embed features. This is also included for bootstrap when theme != NULL.

Side note: This is kind of a duplication because the two first requires the theme argument to be not NULL which will trigger the inclusion of bootstrap and JQuery.

A mentioned above, let's recall that when using theme to use bslib, then the JQuery version used will be the one imported from bslib which is already updated.
Example of YAML:

output:
  html_document:
    theme: 
      version: 4 # or 3

These can be used already without any change in rmarkdown

We'll make the update for when bslib is not used.

[github-actions]

This old thread has been automatically locked. If you think you have found something related to this, please open a new issue by following the issue guide (https://yihui.org/issue/), and link to this old issue if necessary.