jQuery vulnerabilities - Header Manipulation & Code Injection

Sushant_Kagi

Hi All,

Recently while scanning the code with fortify code scanner I came across the two vulonerabilities reported by scanner: Header Manipulation and Code Injection in jquery related files.

Following are my queries:
- Why the values reported by scanner are not validated.
- What is the significance/use of those values.

For Code Injection:

aCookies =document.cookie.split(';');

for ( var i=0, iLen=aCookies.length ; i

allan

Both issues are resolved in DataTables 1.10 which is available as the development version on the downloads page.

Allan

Sushant_Kagi

Allan,

Thanks for the details.

Also the similar type of instances are reported on jquery.js, prototype.js, tiny_mce_dev.js.

Could you help me with the patched versions for the same too.

Thanks in advance.

Sushant

allan

Those are third party libraries over which I have no control. I'd suggest contacting the authors of those libraries if their latest versions are also showing issues.

Allan