[2.2.x] Applied jQuery patch for CVE-2019-11358.

carltongibson · carltongibson · commit baaf187a4e35 · 2019-06-03T11:38:57.000+02:00
Backport of 34ec522 from master.
diff --git a/django/contrib/admin/static/admin/js/vendor/jquery/jquery.js b/django/contrib/admin/static/admin/js/vendor/jquery/jquery.js
@@ -261,8 +261,9 @@ jQuery.extend = jQuery.fn.extend = function() {
 				src = target[ name ];
 				copy = options[ name ];
 
+				// Prevent Object.prototype pollution
 				// Prevent never-ending loop
-				if ( target === copy ) {
+				if ( name === "__proto__" || target === copy ) {
 					continue;
 				}
 
diff --git a/django/contrib/admin/static/admin/js/vendor/jquery/jquery.min.js b/django/contrib/admin/static/admin/js/vendor/jquery/jquery.min.js
diff --git a/docs/releases/2.1.9.txt b/docs/releases/2.1.9.txt
@@ -19,3 +19,14 @@ payload, could result in an clickable JavaScript link.
 link. You may customise the validator by passing a ``validator_class`` kwarg to
 ``AdminURLFieldWidget.__init__()``, e.g. when using
 :attr:`~django.contrib.admin.ModelAdmin.formfield_overrides`.
+
+Patched bundled jQuery for CVE-2019-11358: Prototype pollution
+--------------------------------------------------------------
+
+jQuery before 3.4.0, mishandles ``jQuery.extend(true, {}, ...)`` because of
+``Object.prototype`` pollution. If an unsanitized source object contained an
+enumerable ``__proto__`` property, it could extend the native
+``Object.prototype``.
+
+The bundled version of jQuery used by the Django admin has been patched to
+allow for the ``select2`` library's use of ``jQuery.extend()``.
diff --git a/docs/releases/2.2.2.txt b/docs/releases/2.2.2.txt
@@ -20,6 +20,17 @@ link. You may customise the validator by passing a ``validator_class`` kwarg to
 ``AdminURLFieldWidget.__init__()``, e.g. when using
 :attr:`~django.contrib.admin.ModelAdmin.formfield_overrides`.
 
+Patched bundled jQuery for CVE-2019-11358: Prototype pollution
+--------------------------------------------------------------
+
+jQuery before 3.4.0, mishandles ``jQuery.extend(true, {}, ...)`` because of
+``Object.prototype`` pollution. If an unsanitized source object contained an
+enumerable ``__proto__`` property, it could extend the native
+``Object.prototype``.
+
+The bundled version of jQuery used by the Django admin has been patched to
+allow for the ``select2`` library's use of ``jQuery.extend()``.
+
 Bugfixes
 ========
 

Original file line number	Diff line number	Diff line change
`@@ -261,8 +261,9 @@ jQuery.extend = jQuery.fn.extend = function() {`
`261`	`261`	`src = target[ name ];`
`262`	`262`	`copy = options[ name ];`
`263`	`263`
	`264`	`+ // Prevent Object.prototype pollution`
`264`	`265`	`// Prevent never-ending loop`
`265`		`- if ( target === copy ) {`
	`266`	`+ if ( name === "__proto__" \|\| target === copy ) {`
`266`	`267`	`continue;`
`267`	`268`	`}`
`268`	`269`