Regarding this answer: How to inject jquery to any webpage
The original revision of this answer specified a URL beginning with http:
and shortly afterwards, changed to using a protocol-relative URL based on a suggestion in a comment. Given that this is now a discouraged practice and potentially dangerous, I quickly converted the answer to use https:
explicitly and updated the URL to point to the latest version of jQuery while I was at it.
However, a short time later, my edit was not only rolled back, but the version was also adjusted all the way back to v1.11.1, which was released in 2014, for which several CVEs exist.
Given that this answer is the first thing people see when they Google a simple phrase like "jquery inject" I think it would be prudent to provide an up-to-date and safe answer.
Is there anything that can be done to protect this answer?
javascript:
in 2021 should be considered a grave offense, frankly. I wouldn't worry too much about the jQuery version - someone who can't tell they are loading an old version from 2014 gets what they deserve. As for the rollback - there seems to be only one for now - rollback it again if you think there is a need, and try to reason with the OP. If you see this is going to end up in a rollback war - flag for mod attention and explain that (or wait till the 3rd rollback, as far as I recall this triggers an auto-flag).javascript:
which would be universally compatible across all browsers (or at least the substantial majority) and enable the bookmarklet to run arbitrary JavaScript code.javascript:
syntax and the bookmarklet concept, but have no idea why would anyone recommend a bookmarklet nowadays given that devtools snippets do the same. Anyways, my point was that it is not wrong, just outdated, the old jQuery version being one part of it.