]> source.dussan.org Git - jquery.git/commitdiff
projects / jquery.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: 4fd6912)
Attributes: Don't stringify attributes in the setter
authorMichał Gołębiowski-Owczarek <m.goleb@gmail.com>
Mon, 1 Nov 2021 17:10:23 +0000 (18:10 +0100)
committerGitHub <noreply@github.com>
Mon, 1 Nov 2021 17:10:23 +0000 (18:10 +0100)
Stringifying attributes in the setter was needed for IE <=9 but it breaks
trusted types enforcement when setting a script `src` attribute.

Note that this doesn't mean script execution works. Since jQuery disables all
scripts by changing their type and then executes them by creating fresh script
tags with proper `src` & possibly other attributes, this unwraps any trusted
`src` wrappers, making the script not execute under strict CSP settings.
We might try to fix it in the future in a separate change.

Fixes gh-4948
Closes gh-4949

src/attributes/attr.js patch | blob | history
test/data/mock.php patch | blob | history
test/data/trusted-types-attributes.html [new file with mode: 0644] patch | blob
test/data/trusted-types-attributes.js [new file with mode: 0644] patch | blob
test/middleware-mockserver.js patch | blob | history
test/unit/attributes.js patch | blob | history

diff --git a/src/attributes/attr.js b/src/attributes/attr.js
index 2773a383c5bd1c6f0b2f290296e8639b0b0b45c7..d6d497735a189a6d3be461fbb00b09561c69e21b 100644 (file)
--- a/src/attributes/attr.js
+++ b/src/attributes/attr.js
@@ -50,7 +50,7 @@ jQuery.extend( {
                                return ret;
                        }
 
-                       elem.setAttribute( name, value + "" );
+                       elem.setAttribute( name, value );
                        return value;
                }
 
diff --git a/test/data/mock.php b/test/data/mock.php
index 268ad06efefdc46b42f6eb1de48786663da088e5..c72bea9f319023bf0f823334fe9c671a63f46fbf 100644 (file)
--- a/test/data/mock.php
+++ b/test/data/mock.php
@@ -247,6 +247,12 @@ QUnit.assert.ok( true, "mock executed");';
                echo file_get_contents( __DIR__ . '/trusted-html.html' );
        }
 
+       protected function trustedTypesAttributes( $req ) {
+               header( "Content-Security-Policy: require-trusted-types-for 'script'; report-uri ./mock.php?action=cspLog" );
+               header( 'Content-type: text/html' );
+               echo file_get_contents( __DIR__ . '/trusted-types-attributes.html' );
+       }
+
        protected function errorWithScript( $req ) {
                header( 'HTTP/1.0 404 Not Found' );
                if ( isset( $req->query['withScriptContentType'] ) ) {
diff --git a/test/data/trusted-types-attributes.html b/test/data/trusted-types-attributes.html
new file mode 100644 (file)
index 0000000..1767226
--- /dev/null
+++ b/test/data/trusted-types-attributes.html
@@ -0,0 +1,61 @@
+<!DOCTYPE html>
+<html>
+<head>
+       <meta charset=utf-8 />
+       <title>Trusted HTML attribute tests</title>
+</head>
+<body>
+<div id="qunit-fixture"></div>
+<script src="../../dist/jquery.js"></script>
+<script src="iframeTest.js"></script>
+<script>
+       var i, input, elem, policy,
+               results = [];
+
+       function runTests( messagePrefix, getTrustedScriptUrlWrapper ) {
+               try {
+                       elem = jQuery( "<script><\/script>" )
+                               .attr( "src", getTrustedScriptUrlWrapper( "trusted-types-attributes.js" ) );
+                       elem.appendTo( document.body );
+
+                       results.push( {
+                               actual: elem.attr( "src" ),
+                               expected: "trusted-types-attributes.js",
+                               message: messagePrefix + ": script URL properly set"
+                       } );
+               } catch ( e ) {
+                       results.push( {
+                               actual: "error thrown",
+                               expected: "",
+                               message: messagePrefix + ": error has been thrown"
+                       } );
+               }
+       }
+
+       if ( typeof trustedTypes !== "undefined" ) {
+               policy = trustedTypes.createPolicy( "jquery-test-policy", {
+                       createScriptURL: function( html ) {
+                               return html;
+                       }
+               } );
+
+               runTests( "TrustedScriptURL", function wrapInTrustedScriptUrl( input ) {
+                       return policy.createScriptURL( input );
+               } );
+       } else {
+
+               // No TrustedScriptURL support so let's at least run tests with object wrappers
+               // with a proper `toString` function. See trusted-html.html for more context.
+               runTests( "Object wrapper", function( input ) {
+                       return {
+                               toString: function toString() {
+                                       return input;
+                               }
+                       };
+               } );
+       }
+
+       startIframeTest( results );
+</script>
+</body>
+</html>
diff --git a/test/data/trusted-types-attributes.js b/test/data/trusted-types-attributes.js
new file mode 100644 (file)
index 0000000..907edf8
--- /dev/null
+++ b/test/data/trusted-types-attributes.js
@@ -0,0 +1 @@
+window.testMessage = "script run";
diff --git a/test/middleware-mockserver.js b/test/middleware-mockserver.js
index 0bd44f95b7d4f5285cd62c1021aecc3aeb55a401..ea6a5d2b0d101161559db667c6f61b90879983e0 100644 (file)
--- a/test/middleware-mockserver.js
+++ b/test/middleware-mockserver.js
@@ -264,6 +264,14 @@ var mocks = {
                var body = fs.readFileSync( __dirname + "/data/trusted-html.html" ).toString();
                resp.end( body );
        },
+       trustedTypesAttributes: function( req, resp ) {
+               resp.writeHead( 200, {
+                       "Content-Type": "text/html",
+                       "Content-Security-Policy": "require-trusted-types-for 'script'; report-uri /base/test/data/mock.php?action=cspLog"
+               } );
+               var body = fs.readFileSync( __dirname + "/data/trusted-types-attributes.html" ).toString();
+               resp.end( body );
+       },
        errorWithScript: function( req, resp ) {
                if ( req.query.withScriptContentType ) {
                        resp.writeHead( 404, { "Content-Type": "application/javascript" } );
diff --git a/test/unit/attributes.js b/test/unit/attributes.js
index d83375172bd8e58adcbf8f424b6a34fa4bb50411..2658495ae372a3ed46ce9cc6be9ccbd4652be9f7 100644 (file)
--- a/test/unit/attributes.js
+++ b/test/unit/attributes.js
@@ -1764,3 +1764,23 @@ QUnit.test( "non-lowercase boolean attribute getters should not crash", function
                }
        } );
 } );
+
+
+// Test trustedTypes support in browsers where they're supported (currently Chrome 83+).
+// Browsers with no TrustedScriptURL support still run tests on object wrappers with
+// a proper `toString` function.
+testIframe(
+       "Basic TrustedScriptURL support (gh-4948)",
+       "mock.php?action=trustedTypesAttributes",
+       function( assert, jQuery, window, document, test ) {
+               var done = assert.async();
+
+               assert.expect( 1 );
+
+               test.forEach( function( result ) {
+                       assert.deepEqual( result.actual, result.expected, result.message );
+               } );
+
+               supportjQuery.get( baseURL + "mock.php?action=cspClean" ).then( done );
+       }
+);
jQuery JavaScript Library: https://github.com/jquery/jquery