jQuery Grid Plugin - jqGrid - Topic: Security Issues - Fortify Scan http://www.trirand.com/blog/?page_id=393/feature-request/security-issues-fortify-scan Simple:Press Version 5.7.5.3 tony on Security Issues - Fortify Scan http://www.trirand.com/blog/?page_id=393/feature-request/security-issues-fortify-scan#p30391 Feature Request http://www.trirand.com/blog/?page_id=393/feature-request/security-issues-fortify-scan#p30391 Hello,

Thanks. Will be interested for me too.

Kind Regards

Tony

]]> Tue, 25 Mar 2014 12:10:10 +0200 Marcin on Security Issues - Fortify Scan http://www.trirand.com/blog/?page_id=393/feature-request/security-issues-fortify-scan#p30386 Feature Request http://www.trirand.com/blog/?page_id=393/feature-request/security-issues-fortify-scan#p30386 Thanks tony for the reply and your support
I will run the scan against the changed code and post the results in this thread

Br Marcin

]]> Mon, 24 Mar 2014 12:47:46 +0200 tony on Security Issues - Fortify Scan http://www.trirand.com/blog/?page_id=393/feature-request/security-issues-fortify-scan#p30373 Feature Request http://www.trirand.com/blog/?page_id=393/feature-request/security-issues-fortify-scan#p30373 Hello,

The warnings are actually 2 in cell edit module only and they refer to setTimeout which is used with zero delay – i.e

setTimeout(function(){…}, 0);

Your analyzes software think that this is dangerous, but actually it is not.

I can asure you that I will set the timeout to 1 something like this.

setTimeout(function(){…}, 1);

Just fixed the code in github.

Regards

]]> Wed, 19 Mar 2014 12:37:25 +0200 Marcin on Security Issues - Fortify Scan http://www.trirand.com/blog/?page_id=393/feature-request/security-issues-fortify-scan#p30368 Feature Request http://www.trirand.com/blog/?page_id=393/feature-request/security-issues-fortify-scan#p30368 Hi, I am using a software provided by HP called Fortify

It scans through code as well as through scripts and reports potential security issues

It has found 6 critical issues with jqGrid version 4.6.0

Dynamic Code Evaluation: Code Injection (Input Validation and Representation, Data flow)

  1. The file grid.celledit.js interprets unvalidated user input as source code on line 53. Interpreting user-controlled instructions at run-time can allow attackers to execute malicious code.
  2. The file grid.celledit.js interprets unvalidated user input as source code on line 87. Interpreting user-controlled instructions at run-time can allow attackers to execute malicious code.
  3. The file jquery.jqGrid.js interprets unvalidated user input as source code on line 9959. Interpreting user-controlled instructions at run-time can allow attackers to execute malicious code.
  4. The file jquery.jqGrid.js interprets unvalidated user input as source code on line 9993. Interpreting user-controlled instructions at run-time can allow attackers to execute malicious code.
  5. The file jquery.jqGrid.src.js interprets unvalidated user input as source code on line 9959. Interpreting user-controlled instructions at run-time can allow attackers to execute malicious code.
  6. The file jquery.jqGrid.src.js interprets unvalidated user input as source code on line 9993. Interpreting user-controlled instructions at run-time can allow attackers to execute malicious code.

For us it is very important to have secure code "live" otherwise we cannot use it. How are the chances this issues can be solved?

If you need any details please feel free to contact me!

]]> Tue, 18 Mar 2014 12:34:48 +0200