在企业应用程序中禁止jQuery的策略是否有意义？

Question

Are there any oustanding vulnerabilities (2) in jQuery that haven't been addressed in the latest release, for instance? Any other valid reason why security packages would flag the library as unsafe?

This question is related to (1) but is broader in nature.

(1) - jQuery vulnerability (NVD CVE-2007-2379)

(2) - http://www.networkworld.com/news/2007/040207-javascript-ajax-applications.html

Answer 1

In a word? Nope.

Answer 2

Ask yourself this: if you're planning to develop and deploy an enterprise application that's got enough Javascript code on the client that jQuery seems like a valuable toolkit to use, how much confidence do you have in the client-side security savvy of your own development team ? The "major" frameworks — Dojo, Prototype, jQuery, MooTools, even Qooxdoo — get the attention of some of the most knowledgeable and skilled Javascript coders in the industry, and a huge exposure to testing under a wide variety of conditions.

Besides that, it's really the case that it's your own application code anyway that's going to make or break your security story except in pretty rare cases.

Answer 3

I'm going to let the hard-core security gurus give the final verdict on this one, but I think you're pretty much in the clear simply due to the nature of jQuery as a library . If there is a serious leak, it is bound to be in the underlying JavaScript core, not in a library built on top of it.

Answer 4

我不相信你会在jQuery的浏览器实现中遇到核心安全漏洞的jQuery漏洞。

Answer 5

Jquery or javascript are not vulnerable, it's the websites developers write that are vulnerable because they don't really know the business or because from time to time there is someone smarter than the web expert.

Probably the most dangerous part would be the Ajax requests (Jquery or javascript driven ;-) ) because there is a tendance to relax in security issues.

But that is only the beginning, in any application even if there is not a javascript line, the client / user can use javascript / jquery by himself, using the mere Firebug, that's why verifications are always mandatory in client and overall server.

A quick and simple example: I can change values of a particular form by javascript even if the values are readonly etc...

Answer 6

I agree that jQuery is secure and fine for the enterprise.

However, I would add two caveats based on personal experience we encountered after approving jQuery.

1) jQuery itself is secure, but jQuery plugins may have vulnerabilities (think XSS). When we approved jQuery for use in enterprise, developers suddenly were using random 3rd party plugins which were not easy to screen for vulnerabilities. If you are opening the door to jQuery, you need to be clear about what plugins in the jQuery ecosystem are allowed also.

2) jQuery makes it very easy to do UI effects, which can be both good and bad. We handed off our UI design to a design firm, who went crazy using jQuery for complex UI effects. The customer loved the visuals, but we realized too late that the jQuery UI code was cumulatively very slow in Internet Explorer. As a result, we spent a lot of time optimizing their code for IE. These were not known during dev as everyone was using Firefox/Chrome, which have great JavaScript engines.