Brian May <b...@debian.org> writes:

> $ /usr/bin/uglifyjs --unsafe ./dist/jquery.js -v

Looks like that command reads from STDIN, not the specified file.

Now changed the Makefile to use:

$ /usr/bin/uglifyjs --unsafe < ./dist/jquery.js

which appears to work.

Updated patch attached.
-- 
Brian May <b...@debian.org>
diff -Nru jquery-1.7.2+dfsg/debian/changelog jquery-1.7.2+dfsg/debian/changelog
--- jquery-1.7.2+dfsg/debian/changelog	2014-08-29 19:44:08.000000000 +1000
+++ jquery-1.7.2+dfsg/debian/changelog	2019-05-01 17:38:43.000000000 +1000
@@ -1,3 +1,11 @@
+jquery (1.7.2+dfsg-3.2+deb8u6) jessie-security; urgency=high
+
+  * Non-maintainer upload by the LTS Team.
+  * Fix CVE-2019-11358, jQuery.extend could be used to pollute the native
+    Object.prototype.
+
+ -- Brian May <b...@debian.org>  Wed, 01 May 2019 17:38:43 +1000
+
 jquery (1.7.2+dfsg-3.2) unstable; urgency=medium
 
   * Non-maintainer upload.
diff -Nru jquery-1.7.2+dfsg/debian/patches/CVE-2019-11358.patch jquery-1.7.2+dfsg/debian/patches/CVE-2019-11358.patch
--- jquery-1.7.2+dfsg/debian/patches/CVE-2019-11358.patch	1970-01-01 10:00:00.000000000 +1000
+++ jquery-1.7.2+dfsg/debian/patches/CVE-2019-11358.patch	2019-05-01 17:38:43.000000000 +1000
@@ -0,0 +1,13 @@
+--- a/src/core.js
++++ b/src/core.js
+@@ -334,8 +334,9 @@
+ 				src = target[ name ];
+ 				copy = options[ name ];
+ 
++				// Prevent Object.prototype pollution
+ 				// Prevent never-ending loop
+-				if ( target === copy ) {
++				if ( name === "__proto__" || target === copy ) {
+ 					continue;
+ 				}
+ 
diff -Nru jquery-1.7.2+dfsg/debian/patches/fix_uglify_invocation.patch jquery-1.7.2+dfsg/debian/patches/fix_uglify_invocation.patch
--- jquery-1.7.2+dfsg/debian/patches/fix_uglify_invocation.patch	1970-01-01 10:00:00.000000000 +1000
+++ jquery-1.7.2+dfsg/debian/patches/fix_uglify_invocation.patch	2019-05-01 17:38:43.000000000 +1000
@@ -0,0 +1,11 @@
+--- a/Makefile
++++ b/Makefile
+@@ -96,7 +96,7 @@
+ ${JQ_MIN}: ${JQ}
+ 	@@if test ! -z ${JS_ENGINE}; then \
+ 		echo "Minifying jQuery" ${JQ_MIN}; \
+-		${COMPILER} ${JQ} > ${JQ_MIN}.tmp; \
++		${COMPILER} < ${JQ} > ${JQ_MIN}.tmp; \
+ 		${POST_COMPILER} ${JQ_MIN}.tmp; \
+ 		rm -f ${JQ_MIN}.tmp; \
+ 	else \
diff -Nru jquery-1.7.2+dfsg/debian/patches/series jquery-1.7.2+dfsg/debian/patches/series
--- jquery-1.7.2+dfsg/debian/patches/series	2014-08-27 05:18:32.000000000 +1000
+++ jquery-1.7.2+dfsg/debian/patches/series	2019-05-01 17:38:43.000000000 +1000
@@ -1 +1,3 @@
 build.patch
+fix_uglify_invocation.patch
+CVE-2019-11358.patch

Reply via email to