CVE-2020-11022 affecting JQuery 1.11.0

[Dean Tierney]

Hi Ed,

Our IT's threat detection system has picked up a vulnerability in JQuery 1.11.0 on one of our OpenREM 1.0.0b2 servers (Windows native install)

Do you have any upcoming releases incorporating a newer version of Django?

If not, can Django safely be upgraded independently of OpenREM 1.0.0b2?

Thank you for your help

Dean

[dpla...@gmail.com]

Dear Dean,

I have had a look at this for you.

jQuery 1.11.0 is not a required part of Django.

• It is used in the skin dose map visualisation.
• The bootstrap-datepicker.js code also uses jQuery (used to choose date ranges in the filtered modality pages).

Google's Gemini tells me that the latest version of jQuery built directly into Django 3.2.16 is version 3.5.1.

I have downloaded jQuery 3.5.1, added the jQuery Migrate script (https://github.com/jquery/jquery-migrate) to help me see / debug any issues, and checked if my local OpenREM 1.0dev version works OK.

• So far all I've seen is a few depreciation warnings in the "Console" part of my Chrome browser. These do not affect functionality.
• Skin dose map visualisations work perfectly.
• Date pickers work perfectly on the filtered pages and on the DICOM querying page.

To replace the use of jQuery 1.11.0 in OpenREM with jQuery 3.5.1:

• Download jquery-3.5.1.min.js from the official jQuery site here: https://code.jquery.com/jquery-3.5.1.min.js
• Save the downloaded file to the "openrem\remapp\static\js\" folder of the OpenREM installation
• Delete the jquery-1.11.0.min.js file from the "openrem\remapp\static\js\" folder of the OpenREM installation
• Edit "openrem\remapp\templates\base.html" and replace:

<script src="{{ STATIC_URL }}js/jquery-3.5.1.min.js"></script>

with

<script src="{{ STATIC_URL }}js/jquery-1.11.0.min.js"></script>

• Force reloading on your OpenREM page (hold down shift and press F5).

Hopefully the above is helpful.

Kind regards,

David

[Dean Tierney]

Dear David,

Thank you very much for your help. That certainly is helpful!

Kind regards,

Dean

[dpla...@gmail.com]

I have realised that there is another step to fix this.

As well as putting the new .js file in the "openrem\remapp\static\js" folder, it also needs to be in the js subfolder of your "STATIC_ROOT" folder.

The location of the "STATIC_ROOT" is defined in the local_settings.py file located in the openrem\openremproject folder.