[cve] Migrate jquery.cookie to js.cookie for CVE-2022-23395

desktop/core/src/desktop/js/apps/editor/components/resultGrid/ko.resultDownloadModal.js

@@ -22,6 +22,7 @@ import huePubSub from 'utils/huePubSub';
 import I18n from 'utils/i18n';
 import UUID from 'utils/string/UUID';
 import hueAnalytics from 'utils/hueAnalytics';
+import Cookies from 'js-cookie';
 
 export const NAME = 'download-result-modal';
 
@@ -72,7 +73,7 @@ class DownloadResultModal {
 
     params.executable.toContext(id).then(jsonContext => {
       this.cookieId = 'download-' + id;
-      $.cookie(this.cookieId, null, { expires: -1, path: '/' });
+      Cookies.set(this.cookieId, null, { expires: -1, path: '/' });
 
       this.addAndSubmitDownloadForm(jsonContext, params.format);
 
@@ -84,14 +85,14 @@ class DownloadResultModal {
   trackCookie() {
     let timesChecked = 0;
     this.checkDownloadInterval = window.setInterval(() => {
-      if (!$.cookie(this.cookieId)) {
+      if (!Cookies.get(this.cookieId)) {
         if (timesChecked > 9) {
           this.$downloadProgressModal.show();
         }
       } else {
         window.clearInterval(this.checkDownloadInterval);
         try {
-          const cookieContent = $.cookie(this.cookieId);
+          const cookieContent = Cookies.get(this.cookieId);
           const result = JSON.parse(
             cookieContent
               .substr(1, cookieContent.length - 2)

desktop/core/src/desktop/js/hue.js

@@ -31,6 +31,7 @@ import page from 'page';
 import qq from 'ext/fileuploader.custom.new';
 import fileuploader from 'ext/fileuploader.custom';
 import sprintf from 'sprintf-js';
+import Cookies from 'js-cookie';
 
 import ko from 'ko/ko.all';
 
@@ -117,6 +118,7 @@ window.sqlStatementsParser = sqlStatementsParser;
 window.hplsqlStatementsParser = hplsqlStatementsParser;
 window.sqlUtils = sqlUtils;
 window.createReactComponents = createReactComponents;
+window.Cookies = Cookies;
 
 $(document).ready(async () => {
   await refreshConfig(); // Make sure we have config up front

desktop/core/src/desktop/js/jest/jquery.setup.js

@@ -15,7 +15,6 @@
 // limitations under the License.
 
 import $ from 'jquery';
-import 'jquery.cookie';
 
 global.$ = $;
 global.jQuery = $;

desktop/core/src/desktop/js/jquery/jquery.common.js

@@ -18,7 +18,6 @@ import $ from 'jquery';
 import 'jquery/jquery.migration';
 
 import 'jquery-contextmenu'; // TODO: Remove, it's only used for "old" query builder
-import 'jquery.cookie';
 import 'jquery-form';
 import 'jquery/plugins/jquery.selectize';
 import 'selectize-plugin-clear';

desktop/core/src/desktop/static/desktop/js/admin-wizard-inline.js

@@ -168,10 +168,10 @@ $(document).ready(function () {
     });
   });
 
-  $("#updateSkipWizard").prop('checked', $.cookie("hueLandingPage", { path: "/" }) == "home");
+  $("#updateSkipWizard").prop('checked', Cookies.set("hueLandingPage", { path: "/" }) == "home");
 
   $("#updateSkipWizard").change(function () {
-    $.cookie("hueLandingPage", this.checked ? "home" : "wizard", {
+    Cookies.set("hueLandingPage", this.checked ? "home" : "wizard", {
       path: "/",
       secure: window.location.protocol.indexOf('https') > -1
     });

desktop/core/src/desktop/templates/common_notebook_ko_components.mako

@@ -491,7 +491,7 @@ from desktop.lib.django_util import nonce_attribute
         window.hueAnalytics.log('notebook', 'download' + format);
 
         var self = this;
-        $.cookie('download-' + self.snippet.id(), null, { expires: -1, path: '/' })
+        window.Cookies.set('download-' + self.snippet.id(), null, { expires: -1, path: '/' })
         self.$downloadForm.find('input[name=\'format\']').val(format);
         self.$downloadForm.find('input[name=\'notebook\']').val(ko.mapping.toJSON(self.notebook.getContext()));
         self.$downloadForm.find('input[name=\'snippet\']').val(ko.mapping.toJSON(self.snippet.getContext()));
@@ -502,15 +502,15 @@ from desktop.lib.django_util import nonce_attribute
 
         var timesChecked = 0;
         self.checkDownloadInterval = window.setInterval(function () {
-          if ($.cookie('download-' + self.snippet.id()) === null || typeof $.cookie('download-' + self.snippet.id()) === 'undefined') {
+          if (window.Cookies.get('download-' + self.snippet.id()) === null || typeof window.Cookies.get('download-' + self.snippet.id()) === 'undefined') {
             if (timesChecked == 10) {
               $(self.downloadProgressModalId).modal('show');
             }
           }
           else {
             window.clearInterval(self.checkDownloadInterval);
             try {
-              var cookieContent = $.cookie('download-' + self.snippet.id());
+              var cookieContent = window.Cookies.get('download-' + self.snippet.id());
               var result = JSON.parse(cookieContent.substr(1, cookieContent.length - 2).replace(/\\"/g, '"').replace(/\\054/g, ','));
               self.downloadTruncated(result.truncated);
               self.downloadCounter(result.row_counter);

package.json

@@ -53,7 +53,6 @@
     "jquery-form": "4.3.0",
     "jquery-mousewheel": "3.1.13",
     "jquery-ui": "1.13.2",
-    "jquery.cookie": "1.4.1",
     "knockout": "3.5.1",
     "knockout-sortable": "1.2.0",
     "knockout-switch-case": "2.1.0",
@@ -83,7 +82,8 @@
     "styled-components": "5.3.10",
     "vue": "3.2.0",
     "vue-custom-element": "3.2.14",
-    "vue3-datepicker": "0.2.5"
+    "vue3-datepicker": "0.2.5",
+    "js-cookie": "3.0.5"
   },
   "devDependencies": {
     "@babel/cli": "7.24.8",