Skip to content

Commit d412a7b

Browse files
ctcpipctcpip
committed
Merge branch '1.6.5-sec' into 1.7.3-sec
2 parents 17eeebb + 3877721 commit d412a7b

File tree

13 files changed

+147
-37
lines changed

13 files changed

+147
-37
lines changed

‎.gitmodules‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[submodule "src/sizzle"]
22
path = src/sizzle
3-
url = git://github.com/jquery/sizzle.git
3+
url = https://github.com/jquery/sizzle.git
44
[submodule "test/qunit"]
55
path = test/qunit
6-
url = git://github.com/jquery/qunit.git
6+
url = https://github.com/qunitjs/qunit.git

‎bower.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name" : "jquery",
3-
"version" : "1.7.2",
3+
"version" : "1.7.3-sec",
44
"main" : "./jquery.js",
55
"dependencies": {
66
}

‎component.json‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{
2+
"name" : "jquery",
3+
"version" : "1.6.5-sec",
4+
"main" : "./jquery.js",
5+
"dependencies": {
6+
}
7+
}
8+

‎jquery.js‎

Lines changed: 15 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*!
2-
* jQuery JavaScript Library v1.7.2
2+
* jQuery JavaScript Library v1.7.3-sec
33
* http://jquery.com/
44
*
55
* Copyright 2011, John Resig
@@ -11,7 +11,7 @@
1111
* Copyright 2011, The Dojo Foundation
1212
* Released under the MIT, BSD, and GPL Licenses.
1313
*
14-
* Date: Wed Mar 21 12:46:34 2012 -0700
14+
* Date: Fri Feb 16 00:55:01 2024 -0600
1515
*/
1616
(function( window, undefined ) {
1717

@@ -38,7 +38,8 @@ var jQuery = function( selector, context ) {
3838

3939
// A simple way to check for HTML strings or ID strings
4040
// Prioritize #id over <tag> to avoid XSS via location.hash (#9521)
41-
quickExpr = /^(?:[^#<]*(<[\w\W]+>)[^>]*$|#([\w\-]*)$)/,
41+
// Strict HTML recognition (#11290: must start with <)
42+
quickExpr = /^(?:(<[\w\W]+>)[^>]*|#([\w-]*))$/,
4243

4344
// Check if a string has a non-whitespace character in it
4445
rnotwhite = /\S/,
@@ -210,7 +211,7 @@ jQuery.fn = jQuery.prototype = {
210211
selector: "",
211212

212213
// The current version of jQuery being used
213-
jquery: "1.7.2",
214+
jquery: "1.7.3-sec",
214215

215216
// The default length of a jQuery object is 0
216217
length: 0,
@@ -355,8 +356,9 @@ jQuery.extend = jQuery.fn.extend = function() {
355356
src = target[ name ];
356357
copy = options[ name ];
357358

359+
// Prevent Object.prototype pollution
358360
// Prevent never-ending loop
359-
if ( target === copy ) {
361+
if ( name === "__proto__" || target === copy ) {
360362
continue;
361363
}
362364

@@ -5735,7 +5737,6 @@ var nodeNames = "abbr|article|aside|audio|bdi|canvas|data|datalist|details|figca
57355737
"header|hgroup|mark|meter|nav|output|progress|section|summary|time|video",
57365738
rinlinejQuery = / jQuery\d+="(?:\d+|null)"/g,
57375739
rleadingWhitespace = /^\s+/,
5738-
rxhtmlTag = /<(?!area|br|col|embed|hr|img|input|link|meta|param)(([\w:]+)[^>]*)\/>/ig,
57395740
rtagName = /<([\w:]+)/,
57405741
rtbody = /<tbody/i,
57415742
rhtml = /<|&#?\w+;/,
@@ -5747,7 +5748,6 @@ var nodeNames = "abbr|article|aside|audio|bdi|canvas|data|datalist|details|figca
57475748
rscriptType = /\/(java|ecma)script/i,
57485749
rcleanScript = /^\s*<!(?:\[CDATA\[|\-\-)/,
57495750
wrapMap = {
5750-
option: [ 1, "<select multiple='multiple'>", "</select>" ],
57515751
legend: [ 1, "<fieldset>", "</fieldset>" ],
57525752
thead: [ 1, "<table>", "</table>" ],
57535753
tr: [ 2, "<table><tbody>", "</tbody></table>" ],
@@ -5758,7 +5758,6 @@ var nodeNames = "abbr|article|aside|audio|bdi|canvas|data|datalist|details|figca
57585758
},
57595759
safeFragment = createSafeFragment( document );
57605760

5761-
wrapMap.optgroup = wrapMap.option;
57625761
wrapMap.tbody = wrapMap.tfoot = wrapMap.colgroup = wrapMap.caption = wrapMap.thead;
57635762
wrapMap.th = wrapMap.td;
57645763

@@ -5936,13 +5935,10 @@ jQuery.fn.extend({
59365935
null;
59375936
}
59385937

5939-
59405938
if ( typeof value === "string" && !rnoInnerhtml.test( value ) &&
59415939
( jQuery.support.leadingWhitespace || !rleadingWhitespace.test( value ) ) &&
59425940
!wrapMap[ ( rtagName.exec( value ) || ["", ""] )[1].toLowerCase() ] ) {
59435941

5944-
value = value.replace( rxhtmlTag, "<$1></$2>" );
5945-
59465942
try {
59475943
for (; i < l; i++ ) {
59485944
// Remove element nodes and prevent memory leaks
@@ -6387,8 +6383,6 @@ jQuery.extend({
63876383
if ( !rhtml.test( elem ) ) {
63886384
elem = context.createTextNode( elem );
63896385
} else {
6390-
// Fix "XHTML"-style tags in all browsers
6391-
elem = elem.replace(rxhtmlTag, "<$1></$2>");
63926386

63936387
// Trim whitespace, otherwise indexOf won't work as expected
63946388
var tag = ( rtagName.exec( elem ) || ["", ""] )[1].toLowerCase(),
@@ -6979,7 +6973,7 @@ var r20 = /%20/g,
69796973
rnoContent = /^(?:GET|HEAD)$/,
69806974
rprotocol = /^\/\//,
69816975
rquery = /\?/,
6982-
rscript = /<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi,
6976+
rscript = /<script\b[^<]*(?:(?!<\/script>)<[^<]*)*< *\/ *script *>?/gi,
69836977
rselectTextarea = /^(?:select|textarea)/i,
69846978
rspacesAjax = /\s+/,
69856979
rts = /([?&])_=[^&]*/,
@@ -8046,6 +8040,13 @@ jQuery.ajaxPrefilter( "json jsonp", function( s, originalSettings, jqXHR ) {
80468040

80478041

80488042

8043+
// Prevent auto-execution of scripts when no explicit dataType was provided (See gh-2432)
8044+
jQuery.ajaxPrefilter( function( s ) {
8045+
if ( s.crossDomain ) {
8046+
s.contents.script = false;
8047+
}
8048+
} );
8049+
80498050
// Install script dataType
80508051
jQuery.ajaxSetup({
80518052
accepts: {

‎src/ajax.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ var r20 = /%20/g,
1111
rnoContent = /^(?:GET|HEAD)$/,
1212
rprotocol = /^\/\//,
1313
rquery = /\?/,
14-
rscript = /<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi,
14+
rscript = /<script\b[^<]*(?:(?!<\/script>)<[^<]*)*< *\/ *script *>?/gi,
1515
rselectTextarea = /^(?:select|textarea)/i,
1616
rspacesAjax = /\s+/,
1717
rts = /([?&])_=[^&]*/,

‎src/ajax/script.js‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,12 @@
11
(function( jQuery ) {
22

3+
// Prevent auto-execution of scripts when no explicit dataType was provided (See gh-2432)
4+
jQuery.ajaxPrefilter( function( s ) {
5+
if ( s.crossDomain ) {
6+
s.contents.script = false;
7+
}
8+
} );
9+
310
// Install script dataType
411
jQuery.ajaxSetup({
512
accepts: {

‎src/core.js‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,8 @@ var jQuery = function( selector, context ) {
1717

1818
// A simple way to check for HTML strings or ID strings
1919
// Prioritize #id over <tag> to avoid XSS via location.hash (#9521)
20-
quickExpr = /^(?:[^#<]*(<[\w\W]+>)[^>]*$|#([\w\-]*)$)/,
20+
// Strict HTML recognition (#11290: must start with <)
21+
quickExpr = /^(?:(<[\w\W]+>)[^>]*|#([\w-]*))$/,
2122

2223
// Check if a string has a non-whitespace character in it
2324
rnotwhite = /\S/,
@@ -334,8 +335,9 @@ jQuery.extend = jQuery.fn.extend = function() {
334335
src = target[ name ];
335336
copy = options[ name ];
336337

338+
// Prevent Object.prototype pollution
337339
// Prevent never-ending loop
338-
if ( target === copy ) {
340+
if ( name === "__proto__" || target === copy ) {
339341
continue;
340342
}
341343

‎src/manipulation.js‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@ var nodeNames = "abbr|article|aside|audio|bdi|canvas|data|datalist|details|figca
1818
"header|hgroup|mark|meter|nav|output|progress|section|summary|time|video",
1919
rinlinejQuery = / jQuery\d+="(?:\d+|null)"/g,
2020
rleadingWhitespace = /^\s+/,
21-
rxhtmlTag = /<(?!area|br|col|embed|hr|img|input|link|meta|param)(([\w:]+)[^>]*)\/>/ig,
2221
rtagName = /<([\w:]+)/,
2322
rtbody = /<tbody/i,
2423
rhtml = /<|&#?\w+;/,
@@ -30,7 +29,6 @@ var nodeNames = "abbr|article|aside|audio|bdi|canvas|data|datalist|details|figca
3029
rscriptType = /\/(java|ecma)script/i,
3130
rcleanScript = /^\s*<!(?:\[CDATA\[|\-\-)/,
3231
wrapMap = {
33-
option: [ 1, "<select multiple='multiple'>", "</select>" ],
3432
legend: [ 1, "<fieldset>", "</fieldset>" ],
3533
thead: [ 1, "<table>", "</table>" ],
3634
tr: [ 2, "<table><tbody>", "</tbody></table>" ],
@@ -41,7 +39,6 @@ var nodeNames = "abbr|article|aside|audio|bdi|canvas|data|datalist|details|figca
4139
},
4240
safeFragment = createSafeFragment( document );
4341

44-
wrapMap.optgroup = wrapMap.option;
4542
wrapMap.tbody = wrapMap.tfoot = wrapMap.colgroup = wrapMap.caption = wrapMap.thead;
4643
wrapMap.th = wrapMap.td;
4744

@@ -219,13 +216,10 @@ jQuery.fn.extend({
219216
null;
220217
}
221218

222-
223219
if ( typeof value === "string" && !rnoInnerhtml.test( value ) &&
224220
( jQuery.support.leadingWhitespace || !rleadingWhitespace.test( value ) ) &&
225221
!wrapMap[ ( rtagName.exec( value ) || ["", ""] )[1].toLowerCase() ] ) {
226222

227-
value = value.replace( rxhtmlTag, "<$1></$2>" );
228-
229223
try {
230224
for (; i < l; i++ ) {
231225
// Remove element nodes and prevent memory leaks
@@ -670,8 +664,6 @@ jQuery.extend({
670664
if ( !rhtml.test( elem ) ) {
671665
elem = context.createTextNode( elem );
672666
} else {
673-
// Fix "XHTML"-style tags in all browsers
674-
elem = elem.replace(rxhtmlTag, "<$1></$2>");
675667

676668
// Trim whitespace, otherwise indexOf won't work as expected
677669
var tag = ( rtagName.exec( elem ) || ["", ""] )[1].toLowerCase(),

‎test/unit/ajax.js‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,70 @@ test("jQuery.ajax() - success callbacks - (url, options) syntax", function() {
6565
}, 13);
6666
});
6767

68+
test( "jQuery.ajax() - do not execute js (crossOrigin) 1", 2, function() {
69+
70+
jQuery.ajaxSetup({ timeout: 0 });
71+
72+
stop();
73+
74+
setTimeout(function(){
75+
jQuery.ajax({
76+
url: url( "data/script.php?header=ecma" ),
77+
crossDomain: true,
78+
success: function() {
79+
ok( true, "success" );
80+
},
81+
complete: function() {
82+
ok( true, "complete" );
83+
start();
84+
}
85+
});
86+
}, 13);
87+
} );
88+
89+
test( "jQuery.ajax() - execute js for crossOrigin when dataType option is provided", 3, function() {
90+
91+
jQuery.ajaxSetup({ timeout: 0 });
92+
93+
stop();
94+
95+
setTimeout(function(){
96+
jQuery.ajax({
97+
url: url( "data/script.php?header=ecma" ),
98+
crossDomain: true,
99+
dataType: "script",
100+
success: function() {
101+
ok( true, "success" );
102+
},
103+
complete: function() {
104+
ok( true, "complete" );
105+
start();
106+
}
107+
});
108+
}, 13);
109+
} );
110+
111+
test( "jQuery.ajax() - do not execute js (crossOrigin) 2", 2, function() {
112+
113+
jQuery.ajaxSetup({ timeout: 0 });
114+
115+
stop();
116+
117+
setTimeout(function(){
118+
jQuery.ajax({
119+
url: url( "data/script.php" ),
120+
crossDomain: true,
121+
success: function() {
122+
ok( true, "success" );
123+
},
124+
complete: function() {
125+
ok( true, "complete" );
126+
start();
127+
}
128+
});
129+
}, 13);
130+
} );
131+
68132
test("jQuery.ajax() - success callbacks (late binding)", function() {
69133
expect( 8 );
70134

‎test/unit/core.js‎

Lines changed: 42 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ test("Basic requirements", function() {
1818
});
1919

2020
test("jQuery()", function() {
21-
expect(29);
21+
expect(27);
2222

2323
// Basic constructor's behavior
2424

@@ -62,7 +62,7 @@ test("jQuery()", function() {
6262
var img = jQuery("<img/>");
6363
equal( img.length, 1, "Correct number of elements generated for img" );
6464
equal( img.parent().length, 0, "Make sure that the generated HTML has no parent." );
65-
var div = jQuery("<div/><hr/><code/><b/>");
65+
var div = jQuery("<div></div><hr><code></code><b></b>");
6666
equal( div.length, 4, "Correct number of elements generated for div hr code b" );
6767
equal( div.parent().length, 0, "Make sure that the generated HTML has no parent." );
6868

@@ -103,16 +103,15 @@ test("jQuery()", function() {
103103
// manually clean up detached elements
104104
elem.remove();
105105

106-
equal( jQuery(" <div/> ").length, 1, "Make sure whitespace is trimmed." );
107-
equal( jQuery(" a<div/>b ").length, 1, "Make sure whitespace and other characters are trimmed." );
106+
equal( jQuery("<div></div> ").length, 1, "Make sure whitespace is trimmed." );
108107

109108
var long = "";
110109
for ( var i = 0; i < 128; i++ ) {
111110
long += "12345678";
112111
}
113112

114-
equal( jQuery(" <div>" + long + "</div> ").length, 1, "Make sure whitespace is trimmed on long strings." );
115-
equal( jQuery(" a<div>" + long + "</div>b ").length, 1, "Make sure whitespace and other characters are trimmed on long strings." );
113+
equal( jQuery("<div>" + long + "</div> ").length, 1, "Make sure whitespace is trimmed on long strings." );
114+
116115
});
117116

118117
test("selector state", function() {
@@ -638,6 +637,36 @@ test("jQuery('html', context)", function() {
638637
equal($span.length, 1, "Verify a span created with a div context works, #1763");
639638
});
640639

640+
test("XSS via location.hash", function() {
641+
expect(1);
642+
643+
stop();
644+
jQuery._check9521 = function(x){
645+
ok( x, "script called from #id-like selector with inline handler" );
646+
jQuery("#check9521").remove();
647+
delete jQuery._check9521;
648+
};
649+
650+
var $eCheck9521 = jQuery( '#<img id="check9521" src="no-such-.gif" onerror="jQuery._check9521(false)"' );
651+
652+
if($eCheck9521.length) {
653+
$eCheck9521.appendTo("#main");
654+
}
655+
else {
656+
jQuery._check9521(true);
657+
}
658+
659+
start();
660+
661+
});
662+
663+
test( "jQuery.extend( true, ... ) Object.prototype pollution", function( assert ) {
664+
expect( 1 );
665+
666+
jQuery.extend( true, {}, JSON.parse( "{\"__proto__\": {\"devMode\": true}}" ) );
667+
ok( !( "devMode" in {} ), "Object.prototype not polluted" );
668+
} );
669+
641670
if ( !isLocal ) {
642671
test("jQuery(selector, xml).text(str) - Loaded via XML document", function() {
643672
expect(2);
@@ -953,6 +982,13 @@ test("jQuery.extend(Object, Object)", function() {
953982
deepEqual( options2, options2Copy, "Check if not modified: options2 must not be modified" );
954983
});
955984

985+
QUnit.test( "jQuery.extend( true, ... ) Object.prototype pollution", function( assert ) {
986+
expect( 1 );
987+
988+
jQuery.extend( true, {}, JSON.parse( "{\"__proto__\": {\"devMode\": true}}" ) );
989+
ok( !( "devMode" in {} ), "Object.prototype not polluted" );
990+
} );
991+
956992
test("jQuery.each(Object,Function)", function() {
957993
expect(14);
958994
jQuery.each( [0,1,2], function(i, n){

0 commit comments

Comments
 (0)