3

Regarding this answer: How to inject jquery to any webpage

The original revision of this answer specified a URL beginning with http: and shortly afterwards, changed to using a protocol-relative URL based on a suggestion in a comment. Given that this is now a discouraged practice and potentially dangerous, I quickly converted the answer to use https: explicitly and updated the URL to point to the latest version of jQuery while I was at it.

However, a short time later, my edit was not only rolled back, but the version was also adjusted all the way back to v1.11.1, which was released in 2014, for which several CVEs exist.

Given that this answer is the first thing people see when they Google a simple phrase like "jquery inject" I think it would be prudent to provide an up-to-date and safe answer.

Is there anything that can be done to protect this answer?

12
  • The Q&A you mention is quite outdated as a whole (as I am sure you know): javascript: in 2021 should be considered a grave offense, frankly. I wouldn't worry too much about the jQuery version - someone who can't tell they are loading an old version from 2014 gets what they deserve. As for the rollback - there seems to be only one for now - rollback it again if you think there is a need, and try to reason with the OP. If you see this is going to end up in a rollback war - flag for mod attention and explain that (or wait till the 3rd rollback, as far as I recall this triggers an auto-flag). Mar 19, 2021 at 3:00
  • 2
    @Oleg Valter: How else would you write a bookmarklet if not javascript:?
    – BoltClock
    Mar 19, 2021 at 4:23
  • 3
    @OlegValter I'm interested to know what you would expect to see in a browser bookmarklet instead of javascript: which would be universally compatible across all browsers (or at least the substantial majority) and enable the bookmarklet to run arbitrary JavaScript code.
    – Makyen Mod
    Mar 19, 2021 at 4:24
  • @Makyen, BoltClock - wow, that's a heavy catch :) I specifically meant that in terms of the Q&A in question, not just the answer. I do know the syntax of javascript: syntax and the bookmarklet concept, but have no idea why would anyone recommend a bookmarklet nowadays given that devtools snippets do the same. Anyways, my point was that it is not wrong, just outdated, the old jQuery version being one part of it. Mar 19, 2021 at 4:46
  • 5
    @Oleg Valter: Because bookmarklets do everything you can do via devtools except with a single click...?
    – BoltClock
    Mar 19, 2021 at 4:49
  • 7
    @OlegValter There are also more browsers in the world other than desktop Chrome. While most browsers allow you to run code from the devtools, and even have a way to remember what you've typed, bookmarklets are a viable way of implementing code which the user wants to run from time to time on pages of their own selection. Bookmarklets work on both desktop and mobile (with work), and can be used in environments where other alternatives may be restricted. Casually dismissing them is throwing out an option which may be more appropriate under conditions you are failing to consider.
    – Makyen Mod
    Mar 19, 2021 at 5:00
  • @Makyen - well, I wasn't talking about chrome devtools specifically. FF has a multiline console (given the removal of Scratchpad), Opera - snippets, Edge - same, IE11 - multiline mode (granted, afaik there is no easy save) to name a few. I am not dismissing bookmarklets as such, but do think that nowadays bookmarklets have a limited use-case and should not come without alternatives (well, "grave offense" is too strong a word), especially if the request is "how to inject jQuery to any website". BoltClock - yup, but they also have their set of issues, so I think it is a trade-off. Mar 19, 2021 at 5:45
  • 1
    TBH, I don't think there's anything wrong with keeping around an old answer that was once relevant, even if it encourages a practice that's discouraged today, as long as it's labelled with a relevant version or time frame for context— if that's lacking, I think there's a solid case to be made to add that info. Bear in mind that by updating the answer as you describe though, you're potentially altering the OP's intent, which is a valid reject/ rollback reason. I think the best move here is to post a new answer.
    – zcoop98
    Mar 19, 2021 at 17:16
  • There is another option... given that the question is closed, and the answer isn't gonna be sub 0 score ever, we could simply delete the question. It was certainly useful in it's heyday, but... that's long past.
    – Kevin B
    Mar 31, 2021 at 16:26
  • @KevinB Why would you do that? Many have found the Q/A to be useful: +10 in the past year, and the only technique in the linked question that works for this question is far down on the page. There's nothing wrong with having this one around. Those looking for an answer who get redirected will find that almost all of the other solutions do not work. Mar 31, 2021 at 16:38
  • The answers are all bad practice, however they're all too highly upvoted to delete. The question is closed, so no new better answers can be provided. If people truely do still have this problem, they'd be better served with a new Q/A pair.
    – Kevin B
    Mar 31, 2021 at 16:39
  • The question existing stands in the way of new better content being created.
    – Kevin B
    Mar 31, 2021 at 16:45

1 Answer 1

13

Wrong answers should be downvoted with a comment explaining what the problem is (not edited to become accurate); that way they can serve as a warning to others. You can, of course, add your own (correct) answer too.

Doing all three (downvoting, commenting explaining what the problem is, and writing a correct answer) is maximally useful because then future readers have access to information as to what they should do along with a warning against a bad practice.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .