Bug/19702 bbq.js proto secure

[kevin-foster-uk]

This PR fixes a security issue reported to LimeSurvey (https://bugs.limesurvey.org/view.php?id=19702).

We have patched jquery-bbq.js to prevent injection of proto.

Q	A
Is bugfix?	✔️
New feature?	❌
Breaks BC?	❌
Tests pass?	❌ (tests are failing but its not related to this PR)

[Arhell]

@marcovtwout

[marcovtwout]

The LimeSurvey link is not available without logging in. Is there a public version?

The source change looks good but there are some points to address.

[kevin-foster-uk]

The LimeSurvey link is not available without logging in. Is there a public version?

The source change looks good but there are some points to address.

Login is required but it is open for anyone to create an account. You just need to provide a username and email address.

[marcovtwout]

I checked the upstream project where this issue was also found, but never fixed fully. For the sake of any other projects using jquery-bbq, I suggest to share your solution upstream also.

Links:

• CVE: https://www.cve.org/CVERecord?id=CVE-2021-20086
• Upstream issue: Prototype pollution vulnerability cowboy/jquery-bbq#62
• Upstream PR with partial fix: Prevent prototype pollution in $.deparam cowboy/jquery-bbq#61

Other noteworthy info:

• Latest upstream version: 1.3pre, Last updated: 8/26/2010
• Last version in the wild: 1.4pre, Last updated: 1/15/2013. Removed $.browser reference to work with jQuery 1.9+. Yii is currently using this version although the comment in the minified file wrongly states it's 1.3pre. Upstream PR for 1.4pre: Removed $.browser to support jQuery 1.9 cowboy/jquery-bbq#41
• The removed block denoted by REMOVE IF NOT SUPPORTING IE6/7/8 was not released in any version but there is an upstream PR: Remove legacy browser support cowboy/jquery-bbq#48

[marcovtwout]

@kevin-foster-uk could you look at the above? When this PR is done I can prepare a new yii release.

[kevin-foster-uk]

@kevin-foster-uk could you look at the above? When this PR is done I can prepare a new yii release.

Sorry for the delay I have been on vacation. Will update asap.

[marcovtwout]

Thanks! I'll update the CHANGELOG on master.