Upgrade to jQuery 3

[Ryan J Ollos]

jQuery was upgraded to 1.12.4 in #12348 for the 1.4 release. For 1.5.1 We should upgrade to jQuery 3 and possibly include the jQuery migrate plugin in Trac.

• ​http://api.jquery.com/category/deprecated/deprecated-3.0/
• ​https://jquery.com/upgrade-guide/3.0/#breaking-change-document-ready-handlers-are-now-asynchronous

[Ryan J Ollos]

Upgraded to jQuery 3.2.1 and replaced deprecated functions: log:rjollos.git:t12858_jquery3.

One issue noted so far: setting visibility of elements, like in r14346, results in a flicker on page load.

[Ryan J Ollos]

jQuery 3 drops support for IE6 - 8. While I don't particularly care about those old browsers, I've considered that it might be better to defer jQuery 3 adoption to 1.5.1. I committed a few changes in [16421:16424].

[Ryan J Ollos]

I will do more testing and push the changes in a few days.

[Ryan J Ollos]

We may eventually need a replacement for jQuery Timepicker add-on since it's ​no longer maintained.

[teridon@…]

Should CVE-2020-11022 and CVE-2020-11023 affect the timeline of this enhancement? Or is trac non vulnerable because it doesn't accept HTML input? Reference: ​https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/

[Ryan J Ollos]

Replying to teridon@…:

Should CVE-2020-11022 and CVE-2020-11023 affect the timeline of this enhancement? Or is trac non vulnerable because it doesn't accept HTML input? Reference: ​https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/

We'll upgrade to the latest jQuery in this ticket, whether that be 3.5.1 or a later version.

I don't know if earlier versions of Trac that use jQuery 1.x are impacted. I assume that any HTML created using a jQuery object would be passed through the regex, so anything like the following could be affected: tags/trac-1.4.2/trac/htdocs/js/query.js@:176#L165​. We'd need to know more about the corner cases that make the code vulnerable to XSS.

[Jun Omae]

#13347 was closed as a duplicate.

The current version of jquery shipped with Trac-stable and Trac-dev is 1.12.4 and contains publicly reported vulnerabilities: ​https://snyk.io/vuln/npm:jquery

[figaro]

Copying keyword from duplicate ticket, which was a motivation for posting it.

[Ryan J Ollos]

Latest jQuery is 3.6.0. I'll update the branch with proposed changes.

DONE update JavaScript page.

[Ryan J Ollos]

Proposed changes in log:rjollos.git:t12858_jquery3.

I'm getting some intermittent failures that I haven't determined the cause of yet. The traceback always looks like this:

======================================================================
ERROR: runTest (trac.ticket.tests.functional.main.RegressionTestTicket5602)
Test for regression of https://trac.edgewall.org/ticket/5602
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/Users/rjollos/Documents/Workspace/trac-dev/teo-rjollos.git/trac/tests/functional/better_twill.py", line 439, in _find_by
    return driver.find_element_by_css_selector(args[0])
  File "/Users/rjollos/.pyenv/versions/trac-py395/lib/python3.9/site-packages/selenium/webdriver/remote/webdriver.py", line 598, in find_element_by_css_selector
    return self.find_element(by=By.CSS_SELECTOR, value=css_selector)
  File "/Users/rjollos/.pyenv/versions/trac-py395/lib/python3.9/site-packages/selenium/webdriver/remote/webdriver.py", line 976, in find_element
    return self.execute(Command.FIND_ELEMENT, {
  File "/Users/rjollos/.pyenv/versions/trac-py395/lib/python3.9/site-packages/selenium/webdriver/remote/webdriver.py", line 321, in execute
    self.error_handler.check_response(response)
  File "/Users/rjollos/.pyenv/versions/trac-py395/lib/python3.9/site-packages/selenium/webdriver/remote/errorhandler.py", line 242, in check_response
    raise exception_class(message, screen, stacktrace)
selenium.common.exceptions.NoSuchElementException: Message: Unable to locate element: #propertyform .collapsed .foldable a


The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "/Users/rjollos/Documents/Workspace/trac-dev/teo-rjollos.git/trac/ticket/tests/functional/main.py", line 1322, in runTest
    tc.click('#propertyform .collapsed .foldable a')
  File "/Users/rjollos/Documents/Workspace/trac-dev/teo-rjollos.git/trac/tests/functional/better_twill.py", line 163, in click
    self._find_by(*args, **kwargs).click()
  File "/Users/rjollos/Documents/Workspace/trac-dev/teo-rjollos.git/trac/tests/functional/better_twill.py", line 444, in _find_by
    raise AssertionError('Missing element (%r, %r) in %s' %
AssertionError: Missing element (('#propertyform .collapsed .foldable a',), {}) in file:///Users/rjollos/Documents/Workspace/trac-dev/teo-rjollos.git/testenv/trac/log/RegressionTestTicket5602.html

[Ryan J Ollos]

Replying to Ryan J Ollos:

I'm getting some intermittent failures that I haven't determined the cause of yet. The traceback always looks like this:

Hmmmm, not seeing these failures today in more than a dozen test executions.

[Ryan J Ollos]

Committed r17551 to make this intermittent failure more obvious (timing issue?):

======================================================================
ERROR: runTest (trac.wiki.tests.functional.TestWikiReadonlyAttribute)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/Users/rjollos/Documents/Workspace/trac-dev/teo-rjollos.git/trac/wiki/tests/functional.py", line 236, in runTest
    tc.find(readonly_checkbox)
  File "/Users/rjollos/Documents/Workspace/trac-dev/teo-rjollos.git/trac/tests/functional/better_twill.py", line 209, in find
    raise AssertionError("Regex didn't match: {!r} not found in {}"
AssertionError: Regex didn't match: '<input type="checkbox" name="readonly" id="readonly"/>' not found in file:///Users/rjollos/Documents/Workspace/trac-dev/teo-rjollos.git/testenv/trac/log/TestWikiReadonlyAttribute.html

[Jun Omae]

Yes. I noticed we should check page load and wait for jQuery.ready() on the page load when visiting an URL, submitting a form, clicking a link, etc.: [4aae058ed/jomae.git].

After the changes, 1 failure.

======================================================================
ERROR: runTest (trac.ticket.tests.functional.main.TestTicketTimeline)
Test ticket details on timeline
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/jun66j5/src/tracdev/git/trac/ticket/tests/functional/main.py", line 682, in runTest
    tc.submit(formname='prefs')
  File "/home/jun66j5/src/tracdev/git/trac/tests/functional/better_twill.py", line 400, in submit
    element.click()
  File "/usr/lib/python3.9/contextlib.py", line 124, in __exit__
    next(self.gen)
  File "/home/jun66j5/src/tracdev/git/trac/tests/functional/better_twill.py", line 544, in _wait_for_page_load
    raise AssertionError('Timed out for page load in %s' %
AssertionError: Timed out for page load in file:///home/jun66j5/src/tracdev/git/testenv/trac/log/TestTicketTimeline.html

[Ryan J Ollos]

Looks good. I also see just the one test failure TestTicketTimeline.

[Jun Omae]

The failure occurs because the page is not loaded when the form generates the same of current URL with #. Root cause is lead by <form action="#"> which is introduced in switching to Jinja2 template and HTML5. HTML5 doesn't support empty action attribute of form: [c3c382062/cboos.git].

I think we could use the path of the request rather than <form action="#">: [66f8c7c49/jomae.git]

[Ryan J Ollos]

Replying to Jun Omae:

I think we could use the path of the request rather than <form action="#">: [66f8c7c49/jomae.git]

That looks good. All tests pass for me. Do you want to push the changes?

[Jun Omae]

Replying to Ryan J Ollos:

Replying to Jun Omae:

I think we could use the path of the request rather than <form action="#">: [66f8c7c49/jomae.git]

That looks good. All tests pass for me. Do you want to push the changes?

Yes, if no issue is lead by the changes.

However, the NoSuchElementException randomly happens when finding a element in the foldable element after new ticket is created.

• ​https://travis-ci.com/github/jun66j5/trac/jobs/511529272
• ​https://ci.appveyor.com/project/jun66j5/trac/builds/39485388/job/gyt3r8g72679b2ee
• ​https://github.com/jun66j5/trac/actions/runs/911199074

In [301efb439/jomae.git], add toggle_foldable() method to wait present of a element in foldable element and toggle it, in order to fix it.

• ​https://travis-ci.com/github/jun66j5/trac/builds/228323658
• ​https://ci.appveyor.com/project/jun66j5/trac/builds/39512012
• ​https://github.com/jun66j5/trac/actions/runs/918420079

[Ryan J Ollos]

The changes look good. I ran the tests a half-dozen times on macOS with no failures.

[Ryan J Ollos]

Do you think the changes are ready to push? They look good to me.

[Ryan J Ollos]

Committed changes to trunk in r17562.

[Ryan J Ollos]

Edited TracDev/ApiChanges/1.6@5.

[Ryan J Ollos]

⇒ #13494