Fortify SCA flagged this line of code as a vulnerability, with the following warning: The call to on() in jquery.validate.js on sets a callback that could lead to a race condition
However based on my understanding, I don't see how is it setting a callback that might induce a race condition. Isn't it only listening for the "submit.validate" event?
How do I resolve this? Is this a vulnerability? I checked the CVE and security advisories in the github repo and I see no mention of it.
this.on("submit.validate", function(event) {
if (validator.settings.debug) {
// Prevent form submit to be able to see console output
event.preventDefault();
}
function handle() {
var hidden, result;
// Insert a hidden input as a replacement for the missing submit button
// The hidden input is inserted in two cases:
// - A user defined a `submitHandler`
// - There was a pending request due to `remote` method and `stopRequest()`
// was called to submit the form in case it's valid
if (validator.submitButton && (validator.settings.submitHandler || validator.formSubmitted)) {
hidden = $("<input type='hidden'/>")
.attr("name", validator.submitButton.name)
.val($(validator.submitButton).val())
.appendTo(validator.currentForm);
}
if (validator.settings.submitHandler) {
result = validator.settings.submitHandler.call(validator, validator.currentForm, event);
if (hidden) {
// And clean up afterwards; thanks to no-block-scope, hidden can be referenced
hidden.remove();
}
if (result !== undefined) {
return result;
}
return false;
}
return true;
}
// Prevent submit for invalid forms or custom submit handlers
if (validator.cancelSubmit) {
validator.cancelSubmit = false;
return handle();
}
if (validator.form()) {
if (validator.pendingRequest) {
validator.formSubmitted = true;
return false;
}
return handle();
} else {
validator.focusInvalid();
return false;
}
});