Skip to content

Commit 6446298

Browse files
ctcpipctcpip
committed
Merge branch '1.4.5-sec' into 1.5.3-sec
2 parents fa65c2b + 634d27d commit 6446298

File tree

11 files changed

+127
-30
lines changed

11 files changed

+127
-30
lines changed

‎component.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name" : "jquery",
3-
"version" : "1.5.2",
3+
"version" : "1.5.3-sec",
44
"main" : "./jquery.js",
55
"dependencies": {
66
}

‎jquery.js‎

Lines changed: 16 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*!
2-
* jQuery JavaScript Library v1.5.2
2+
* jQuery JavaScript Library v1.5.3-sec
33
* http://jquery.com/
44
*
55
* Copyright 2011, John Resig
@@ -11,7 +11,7 @@
1111
* Copyright 2011, The Dojo Foundation
1212
* Released under the MIT, BSD, and GPL Licenses.
1313
*
14-
* Date: Thu Mar 31 15:28:23 2011 -0400
14+
* Date: Thu Feb 15 18:40:42 2024 -0600
1515
*/
1616
(function( window, undefined ) {
1717

@@ -35,8 +35,9 @@ var jQuery = function( selector, context ) {
3535
rootjQuery,
3636

3737
// A simple way to check for HTML strings or ID strings
38-
// (both of which we optimize for)
39-
quickExpr = /^(?:[^<]*(<[\w\W]+>)[^>]*$|#([\w\-]+)$)/,
38+
// Prioritize #id over <tag> to avoid XSS via location.hash (#9521)
39+
// Strict HTML recognition (#11290: must start with <)
40+
quickExpr = /^(?:(<[\w\W]+>)[^>]*|#([\w-]*))$/,
4041

4142
// Check if a string has a non-whitespace character in it
4243
rnotwhite = /\S/,
@@ -196,7 +197,7 @@ jQuery.fn = jQuery.prototype = {
196197
selector: "",
197198

198199
// The current version of jQuery being used
199-
jquery: "1.5.2",
200+
jquery: "1.5.3-sec",
200201

201202
// The default length of a jQuery object is 0
202203
length: 0,
@@ -340,8 +341,9 @@ jQuery.extend = jQuery.fn.extend = function() {
340341
src = target[ name ];
341342
copy = options[ name ];
342343

344+
// Prevent Object.prototype pollution
343345
// Prevent never-ending loop
344-
if ( target === copy ) {
346+
if ( name === "__proto__" || target === copy ) {
345347
continue;
346348
}
347349

@@ -5035,15 +5037,13 @@ function winnow( elements, qualifier, keep ) {
50355037

50365038
var rinlinejQuery = / jQuery\d+="(?:\d+|null)"/g,
50375039
rleadingWhitespace = /^\s+/,
5038-
rxhtmlTag = /<(?!area|br|col|embed|hr|img|input|link|meta|param)(([\w:]+)[^>]*)\/>/ig,
50395040
rtagName = /<([\w:]+)/,
50405041
rtbody = /<tbody/i,
50415042
rhtml = /<|&#?\w+;/,
50425043
rnocache = /<(?:script|object|embed|option|style)/i,
50435044
// checked="checked" or checked
50445045
rchecked = /checked\s*(?:[^=]|=\s*.checked.)/i,
50455046
wrapMap = {
5046-
option: [ 1, "<select multiple='multiple'>", "</select>" ],
50475047
legend: [ 1, "<fieldset>", "</fieldset>" ],
50485048
thead: [ 1, "<table>", "</table>" ],
50495049
tr: [ 2, "<table><tbody>", "</tbody></table>" ],
@@ -5053,7 +5053,6 @@ var rinlinejQuery = / jQuery\d+="(?:\d+|null)"/g,
50535053
_default: [ 0, "", "" ]
50545054
};
50555055

5056-
wrapMap.optgroup = wrapMap.option;
50575056
wrapMap.tbody = wrapMap.tfoot = wrapMap.colgroup = wrapMap.caption = wrapMap.thead;
50585057
wrapMap.th = wrapMap.td;
50595058

@@ -5236,8 +5235,6 @@ jQuery.fn.extend({
52365235
(jQuery.support.leadingWhitespace || !rleadingWhitespace.test( value )) &&
52375236
!wrapMap[ (rtagName.exec( value ) || ["", ""])[1].toLowerCase() ] ) {
52385237

5239-
value = value.replace(rxhtmlTag, "<$1></$2>");
5240-
52415238
try {
52425239
for ( var i = 0, l = this.length; i < l; i++ ) {
52435240
// Remove element nodes and prevent memory leaks
@@ -5607,8 +5604,6 @@ jQuery.extend({
56075604
elem = context.createTextNode( elem );
56085605

56095606
} else if ( typeof elem === "string" ) {
5610-
// Fix "XHTML"-style tags in all browsers
5611-
elem = elem.replace(rxhtmlTag, "<$1></$2>");
56125607

56135608
// Trim whitespace, otherwise indexOf won't work as expected
56145609
var tag = (rtagName.exec( elem ) || ["", ""])[1].toLowerCase(),
@@ -6111,7 +6106,7 @@ var r20 = /%20/g,
61116106
rnoContent = /^(?:GET|HEAD)$/,
61126107
rprotocol = /^\/\//,
61136108
rquery = /\?/,
6114-
rscript = /<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi,
6109+
rscript = /<script\b[^<]*(?:(?!<\/script>)<[^<]*)*< *\/ *script *>?/gi,
61156110
rselectTextarea = /^(?:select|textarea)/i,
61166111
rspacesAjax = /\s+/,
61176112
rts = /([?&])_=[^&]*/,
@@ -7162,6 +7157,13 @@ jQuery.ajaxPrefilter( "json jsonp", function( s, originalSettings, jqXHR ) {
71627157

71637158

71647159

7160+
// Prevent auto-execution of scripts when no explicit dataType was provided (See gh-2432)
7161+
jQuery.ajaxPrefilter( function( s ) {
7162+
if ( s.crossDomain ) {
7163+
s.contents.script = false;
7164+
}
7165+
} );
7166+
71657167
// Install script dataType
71667168
jQuery.ajaxSetup({
71677169
accepts: {

‎src/ajax.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ var r20 = /%20/g,
1111
rnoContent = /^(?:GET|HEAD)$/,
1212
rprotocol = /^\/\//,
1313
rquery = /\?/,
14-
rscript = /<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi,
14+
rscript = /<script\b[^<]*(?:(?!<\/script>)<[^<]*)*< *\/ *script *>?/gi,
1515
rselectTextarea = /^(?:select|textarea)/i,
1616
rspacesAjax = /\s+/,
1717
rts = /([?&])_=[^&]*/,

‎src/ajax/script.js‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,12 @@
11
(function( jQuery ) {
22

3+
// Prevent auto-execution of scripts when no explicit dataType was provided (See gh-2432)
4+
jQuery.ajaxPrefilter( function( s ) {
5+
if ( s.crossDomain ) {
6+
s.contents.script = false;
7+
}
8+
} );
9+
310
// Install script dataType
411
jQuery.ajaxSetup({
512
accepts: {

‎src/core.js‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,9 @@ var jQuery = function( selector, context ) {
1616
rootjQuery,
1717

1818
// A simple way to check for HTML strings or ID strings
19-
// (both of which we optimize for)
20-
quickExpr = /^(?:[^<]*(<[\w\W]+>)[^>]*$|#([\w\-]+)$)/,
19+
// Prioritize #id over <tag> to avoid XSS via location.hash (#9521)
20+
// Strict HTML recognition (#11290: must start with <)
21+
quickExpr = /^(?:(<[\w\W]+>)[^>]*|#([\w-]*))$/,
2122

2223
// Check if a string has a non-whitespace character in it
2324
rnotwhite = /\S/,
@@ -321,8 +322,9 @@ jQuery.extend = jQuery.fn.extend = function() {
321322
src = target[ name ];
322323
copy = options[ name ];
323324

325+
// Prevent Object.prototype pollution
324326
// Prevent never-ending loop
325-
if ( target === copy ) {
327+
if ( name === "__proto__" || target === copy ) {
326328
continue;
327329
}
328330

‎src/manipulation.js‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,13 @@
22

33
var rinlinejQuery = / jQuery\d+="(?:\d+|null)"/g,
44
rleadingWhitespace = /^\s+/,
5-
rxhtmlTag = /<(?!area|br|col|embed|hr|img|input|link|meta|param)(([\w:]+)[^>]*)\/>/ig,
65
rtagName = /<([\w:]+)/,
76
rtbody = /<tbody/i,
87
rhtml = /<|&#?\w+;/,
98
rnocache = /<(?:script|object|embed|option|style)/i,
109
// checked="checked" or checked
1110
rchecked = /checked\s*(?:[^=]|=\s*.checked.)/i,
1211
wrapMap = {
13-
option: [ 1, "<select multiple='multiple'>", "</select>" ],
1412
legend: [ 1, "<fieldset>", "</fieldset>" ],
1513
thead: [ 1, "<table>", "</table>" ],
1614
tr: [ 2, "<table><tbody>", "</tbody></table>" ],
@@ -20,7 +18,6 @@ var rinlinejQuery = / jQuery\d+="(?:\d+|null)"/g,
2018
_default: [ 0, "", "" ]
2119
};
2220

23-
wrapMap.optgroup = wrapMap.option;
2421
wrapMap.tbody = wrapMap.tfoot = wrapMap.colgroup = wrapMap.caption = wrapMap.thead;
2522
wrapMap.th = wrapMap.td;
2623

@@ -203,8 +200,6 @@ jQuery.fn.extend({
203200
(jQuery.support.leadingWhitespace || !rleadingWhitespace.test( value )) &&
204201
!wrapMap[ (rtagName.exec( value ) || ["", ""])[1].toLowerCase() ] ) {
205202

206-
value = value.replace(rxhtmlTag, "<$1></$2>");
207-
208203
try {
209204
for ( var i = 0, l = this.length; i < l; i++ ) {
210205
// Remove element nodes and prevent memory leaks
@@ -574,8 +569,6 @@ jQuery.extend({
574569
elem = context.createTextNode( elem );
575570

576571
} else if ( typeof elem === "string" ) {
577-
// Fix "XHTML"-style tags in all browsers
578-
elem = elem.replace(rxhtmlTag, "<$1></$2>");
579572

580573
// Trim whitespace, otherwise indexOf won't work as expected
581574
var tag = (rtagName.exec( elem ) || ["", ""])[1].toLowerCase(),

‎test/unit/ajax.js‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,69 @@ test("jQuery.ajax() - success callbacks - (url, options) syntax", function() {
7070
}, 13);
7171
});
7272

73+
test("jQuery.ajax() - do not execute js (crossOrigin)", function() {
74+
expect(2);
75+
76+
var base = window.location.href.replace(/[^\/]*$/, "");
77+
78+
stop();
79+
80+
jQuery.ajax({
81+
url: base + "data/script.php?header=ecma",
82+
crossDomain: true,
83+
success: function(data){
84+
ok( true, "success" );
85+
start();
86+
},
87+
complete: function() {
88+
ok( true, "complete" );
89+
}
90+
});
91+
});
92+
93+
test( "jQuery.ajax() - execute js for crossOrigin when dataType option is provided",
94+
function() {
95+
expect(3);
96+
97+
var base = window.location.href.replace(/[^\/]*$/, "");
98+
99+
stop();
100+
101+
jQuery.ajax({
102+
url: base + "data/script.php?header=ecma",
103+
crossDomain: true,
104+
dataType: "script",
105+
success: function(data){
106+
ok( true, "success" );
107+
start();
108+
},
109+
complete: function() {
110+
ok( true, "complete" );
111+
}
112+
});
113+
}
114+
);
115+
116+
test("jQuery.ajax() - do not execute js (crossOrigin)", function() {
117+
expect(2);
118+
119+
var base = window.location.href.replace(/[^\/]*$/, "");
120+
121+
stop();
122+
123+
jQuery.ajax({
124+
url: base + "data/script.php",
125+
crossDomain: true,
126+
success: function(data){
127+
ok( true, "success" );
128+
start();
129+
},
130+
complete: function() {
131+
ok( true, "complete" );
132+
}
133+
});
134+
});
135+
73136
test("jQuery.ajax() - success callbacks (late binding)", function() {
74137
expect( 8 );
75138

‎test/unit/core.js‎

Lines changed: 31 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ test("jQuery()", function() {
5555
var img = jQuery("<img/>");
5656
equals( img.length, 1, "Correct number of elements generated for img" );
5757
equals( img.parent().length, 0, "Make sure that the generated HTML has no parent." );
58-
var div = jQuery("<div/><hr/><code/><b/>");
58+
var div = jQuery("<div></div><hr><code></code><b></b>");
5959
equals( div.length, 4, "Correct number of elements generated for div hr code b" );
6060
equals( div.parent().length, 0, "Make sure that the generated HTML has no parent." );
6161

@@ -510,6 +510,36 @@ test("jQuery('html', context)", function() {
510510
equals($span.length, 1, "Verify a span created with a div context works, #1763");
511511
});
512512

513+
test("XSS via location.hash", function() {
514+
expect(1);
515+
516+
stop();
517+
jQuery._check9521 = function(x){
518+
ok( x, "script called from #id-like selector with inline handler" );
519+
jQuery("#check9521").remove();
520+
delete jQuery._check9521;
521+
};
522+
523+
var $eCheck9521 = jQuery( '#<img id="check9521" src="no-such-.gif" onerror="jQuery._check9521(false)"' );
524+
525+
if($eCheck9521.length) {
526+
$eCheck9521.appendTo("#main");
527+
}
528+
else {
529+
jQuery._check9521(true);
530+
}
531+
532+
start();
533+
534+
});
535+
536+
test( "jQuery.extend( true, ... ) Object.prototype pollution", function( assert ) {
537+
expect( 1 );
538+
539+
jQuery.extend( true, {}, JSON.parse( "{\"__proto__\": {\"devMode\": true}}" ) );
540+
ok( !( "devMode" in {} ), "Object.prototype not polluted" );
541+
} );
542+
513543
if ( !isLocal ) {
514544
test("jQuery(selector, xml).text(str) - Loaded via XML document", function() {
515545
expect(2);

‎test/unit/css.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ test("css(String|Hash)", function() {
2323
equals( div.css("width"), "4px", "Width on disconnected node." );
2424
equals( div.css("height"), "4px", "Height on disconnected node." );
2525

26-
var div2 = jQuery( "<div style='display:none;'><input type='text' style='height:20px;'/><textarea style='height:20px;'/><div style='height:20px;'></div></div>").appendTo("body");
26+
var div2 = jQuery( "<div style='display:none;'><input type='text' style='height:20px;'/><textarea style='height:20px;'></textarea><div style='height:20px;'></div></div>").appendTo("body");
2727

2828
equals( div2.find("input").css("height"), "20px", "Height on hidden input." );
2929
equals( div2.find("textarea").css("height"), "20px", "Height on hidden textarea." );

‎test/unit/manipulation.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1068,7 +1068,7 @@ var testHtml = function(valueObj) {
10681068
}
10691069
ok( pass, "Set HTML" );
10701070

1071-
div = jQuery("<div/>").html( valueObj('<div id="parent_1"><div id="child_1"/></div><div id="parent_2"/>') );
1071+
div = jQuery("<div>").html( valueObj("<div id='parent_1'><div id='child_1'></div></div><div id='parent_2'></div>") );
10721072

10731073
equals( div.children().length, 2, "Make sure two child nodes exist." );
10741074
equals( div.children().children().length, 1, "Make sure that a grandchild exists." );

0 commit comments

Comments
 (0)