Hacker News Reader

There was some discussion about this on an earlier jQuery-update-thread: There's no urgent need to update your sites to the most recent version. Other than with server side software, you have close to no security issues when using an older version.

View on HN

That's not quite true about security. There is a very bad practice some ajaxy sites have where they select parts of the page using `$(location.hash)` [1]. Since that string is in the URL and entirely in control of outside code, it's pretty easy to get the page to run something that might send information to a third party. That particular hole was closed in jQuery 1.6.4 but there are still plenty of people running older versions.

We're tightening this down even further in 1.9 to prevent a few other cases, which I am sure will break some code, but the only real solution is good input hygiene and HTML escaping on the part of the application itself.

[1] http://jsfiddle.net/dmethvin/uKYUP/

That's why I wrote 'close to no security issues'.

What I didn't realise is that jQuery 1.6 is only from last year.

Reply on news.ycombinator.com