0

Recently we have made pen-test on Magento 2.3.3 version.

We have received the following issues.

Vulnerable Javascript Library Versions In Use

adminhtml/Magento/backend/en_US/jquery/jquery-ui-1.9.2.js adminhtml/Magento/backend/en_US/knockoutjs/knockout.js adminhtml/Magento/backend/en_US/jquery.js

Can we upgrade these library files to latest versions?

How this can be achieved? Can anyone help me with the steps to implement it.

Thanks in Advance!!

1

Go to app\design\frontend\Vendor\Theme\Magento_Theme\layout\default_head_blocks.xml. create if not exist

 <page xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:View/Layout/etc/page_configuration.xsd">
<head>
    <!--Remove default jquery, or it will cause conflict-->
    <remove src="lib\web\jquery\jquery.js"/>
    <remove src="lib\web\knockoutjs\knockoutjs.js"/>
    <remove src="lib\web\jquery\jquery-ui.js"/>
    <!--Include CDN-->
    <script
          src="https://code.jquery.com/jquery-3.2.1.min.js"
          integrity="sha256-hwg4gsxgFZhOsEEamdOYGBf13FyQuiTwlAQgxVSNgt4="
          crossorigin="anonymous" src_type="url"></script>
    <script
          src="https://cdnjs.cloudflare.com/ajax/libs/knockout/3.5.0/knockout-debug.js"
          integrity="sha256-hwg4gsxgFZhOsEEamdOYGBf13FyQuiTwlAQgxVSNgt4="
          crossorigin="anonymous" src_type="url"></script>

    <script
          src="https://cdnjs.cloudflare.com/ajax/libs/jqueryui/1.12.1/jquery-ui.js"
          integrity="sha256-hwg4gsxgFZhOsEEamdOYGBf13FyQuiTwlAQgxVSNgt4="
          crossorigin="anonymous" src_type="url"></script>
</head>
| improve this answer | |
  • hi @Divyesh, what about knockoutjs and jquery-ui file? how can we upgrade them? – jafar pinjar Oct 30 '19 at 11:31
  • same you can try with knockout . – Divyesh Oct 30 '19 at 11:39
  • can you pls update code for other 2 js as well? – jafar pinjar Oct 30 '19 at 11:43
  • check updated answer @jafarpinjar – Divyesh Oct 30 '19 at 11:48
  • okay let me try this. – jafar pinjar Oct 30 '19 at 11:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.