patch jquery's extend

common/static/js/src/jquery_extend_patch.js

@@ -0,0 +1,83 @@
+/*
+
+`extend` function of jquery (jQuery < 3.4.0) is known to have Prototype Pollution vulnerability.
+This IIFE is used to rebind `extend` function with its patched implementation.
+
+TODO: Remove this file and all its uses after upgrading to version >= 3.4.0
+
+*/
+
+(function(){
+    
+    jQuery.extend = jQuery.fn.extend = function() {
+        var options, name, src, copy, copyIsArray, clone,
+            target = arguments[ 0 ] || {},
+            i = 1,
+            length = arguments.length,
+            deep = false;
+    
+        // Handle a deep copy situation
+        if ( typeof target === "boolean" ) {
+            deep = target;
+    
+            // Skip the boolean and the target
+            target = arguments[ i ] || {};
+            i++;
+        }
+    
+        // Handle case when target is a string or something (possible in deep copy)
+        if ( typeof target !== "object" && !jQuery.isFunction( target ) ) {
+            target = {};
+        }
+    
+        // Extend jQuery itself if only one argument is passed
+        if ( i === length ) {
+            target = this;
+            i--;
+        }
+    
+        for ( ; i < length; i++ ) {
+    
+            // Only deal with non-null/undefined values
+            if ( ( options = arguments[ i ] ) != null ) {
+    
+                // Extend the base object
+                for ( name in options ) {
+                    copy = options[ name ];
+    
+                    // Prevent Object.prototype pollution
+                    // Prevent never-ending loop
+                    if ( name === "__proto__" || target === copy ) {
+                        continue;
+                    }
+    
+                    // Recurse if we're merging plain objects or arrays
+                    if ( deep && copy && ( jQuery.isPlainObject( copy ) ||
+                        ( copyIsArray = Array.isArray( copy ) ) ) ) {
+                        src = target[ name ];
+    
+                        // Ensure proper type for the source value
+                        if ( copyIsArray && !Array.isArray( src ) ) {
+                            clone = [];
+                        } else if ( !copyIsArray && !jQuery.isPlainObject( src ) ) {
+                            clone = {};
+                        } else {
+                            clone = src;
+                        }
+                        copyIsArray = false;
+    
+                        // Never move original objects, clone them
+                        target[ name ] = jQuery.extend( deep, clone, copy );
+    
+                    // Don't bring in undefined values
+                    } else if ( copy !== undefined ) {
+                        target[ name ] = copy;
+                    }
+                }
+            }
+        }
+    
+        // Return the modified object
+        return target;
+    };
+})();