LPS-125854 Fix XSS validating context and encoding HTML

modules/.eslintignore

@@ -48,4 +48,5 @@
     # These are generated third-party files, not intended for editing or
     # inspection.
     #
+    apps/frontend-js/frontend-js-jquery-web/src/main/resources/META-INF/resources/jquery/form.js
     apps/frontend-js/frontend-js-svg4everybody-web/src/main/resources/META-INF/resources/svg4everybody.js

modules/.prettierignore

@@ -47,5 +47,6 @@
     # These are generated third-party files, not intended for editing or
     # inspection.
     #
+    /apps/frontend-js/frontend-js-jquery-web/src/main/resources/META-INF/resources/jquery/form.js
     /apps/frontend-js/frontend-js-svg4everybody-web/src/main/resources/META-INF/resources/svg4everybody.js
     /yarn-*.js

modules/apps/frontend-js/frontend-js-jquery-web/build.gradle

@@ -1,11 +1,21 @@
+import com.liferay.gradle.plugins.defaults.internal.util.GitUtil
+import com.liferay.gradle.util.FileUtil
 import com.liferay.gradle.util.copy.StripPathSegmentsAction
 
+ext {
+	jQueryFormVersion = "3.51"
+
+	jQueryFormURL = "https://raw.githubusercontent.com/jquery-form/form/${jQueryFormVersion}/jquery.form.js"
+}
+
 task buildBootstrapJS(type: Copy)
 task buildJQuery(type: Copy)
+task buildJQueryForm(type: Copy)
 task buildPopperJS(type: Copy)
+task patchJQueryForm(type: Copy)
 
 File jsDestinationDir = file("tmp/META-INF/resources")
-File jqueryDestinationDir = new File(jsDestinationDir, "jquery")
+File jQueryDestinationDir = new File(jsDestinationDir, "jquery")
 
 buildBootstrapJS {
 	dependsOn buildJQuery
@@ -18,14 +28,14 @@ buildBootstrapJS {
 	include "bootstrap/dist/js/bootstrap.bundle.min.js.map"
 
 	includeEmptyDirs = false
-	into jqueryDestinationDir
+	into jQueryDestinationDir
 }
 
 buildJQuery {
 	dependsOn npmInstall
 
 	doFirst {
-		delete jqueryDestinationDir
+		delete jQueryDestinationDir
 	}
 
 	eachFile new StripPathSegmentsAction(2)
@@ -36,7 +46,26 @@ buildJQuery {
 	include "jquery/dist/jquery.min.js.map"
 
 	includeEmptyDirs = false
-	into jqueryDestinationDir
+	into jQueryDestinationDir
+}
+
+buildJQueryForm {
+	File jQueryFormURLFile = file("src/main/resources/META-INF/resources/jquery/form.js")
+
+	ext {
+		autoClean = false
+	}
+
+	from {
+		FileUtil.get(project, project.jQueryFormURL, jQueryFormURLFile)
+	}
+
+	into jQueryFormURLFile.parentFile
+
+	eachFile {
+		GitUtil.getGitResult(project, "apply", "-v",
+		"src/main/resources/META-INF/resources/_diffs/jquery.form.patch")
+	}
 }
 
 buildPopperJS {
@@ -50,12 +79,13 @@ buildPopperJS {
 	include "popper.js/dist/umd/popper.min.js.map"
 
 	includeEmptyDirs = false
-	into jqueryDestinationDir
+	into jQueryDestinationDir
 }
 
 classes {
 	dependsOn buildBootstrapJS
 	dependsOn buildJQuery
+	dependsOn buildJQueryForm
 	dependsOn buildPopperJS
 }
 

modules/apps/frontend-js/frontend-js-jquery-web/src/main/resources/META-INF/resources/_diffs/jquery.form.patch

@@ -0,0 +1,39 @@
+diff --git a/modules/apps/frontend-js/frontend-js-jquery-web/src/main/resources/META-INF/resources/jquery/form.js b/modules/apps/frontend-js/frontend-js-jquery-web/src/main/resources/META-INF/resources/jquery/form.js
+index 591ad6f1fe7b..04cf9498c9a2 100644
+--- a/modules/apps/frontend-js/frontend-js-jquery-web/src/main/resources/META-INF/resources/jquery/form.js
++++ b/modules/apps/frontend-js/frontend-js-jquery-web/src/main/resources/META-INF/resources/jquery/form.js
+@@ -13,7 +13,7 @@
+ // AMD support
+ (function (factory) {
+     "use strict";
+-    if (typeof define === 'function' && define.amd) {
++    if (false && typeof define === 'function' && define.amd) {
+         // using AMD; register as anon module
+         define(['jquery'], factory);
+     } else {
+@@ -190,6 +190,11 @@ $.fn.ajaxSubmit = function(options) {
+         var oldSuccess = options.success || function(){};
+         callbacks.push(function(data) {
+             var fn = options.replaceTarget ? 'replaceWith' : 'html';
++
++            data = options.replaceTarget
++                ? data
++                : $.parseHTML($('<div>').text(data).html());
++
+             $(options.target)[fn](data).each(oldSuccess, arguments);
+         });
+     }
+@@ -800,9 +805,10 @@ $.fn.ajaxSubmit = function(options) {
+             }
+             return (doc && doc.documentElement && doc.documentElement.nodeName != 'parsererror') ? doc : null;
+         };
+-        var parseJSON = $.parseJSON || function(s) {
+-            /*jslint evil:true */
+-            return window['eval']('(' + s + ')');
++        var parseJSON = $.parseJSON || function() {
++            window.console.error('jQuery.paseJSON is undefined');
++
++            return null;
+         };
+
+         var httpData = function( xhr, type, s ) { // mostly lifted from jq1.4.4