Core: use document.implemenation.createHTMLDocument in jQuery.parseHTML

Close gh-1505

diff --git a/src/core.js b/src/core.js
index fa8436a01220af92ad24914a4af1db0a78be30f1..dab633f9c26c665fadccd6d7480c15fcf814aa47 100644 (file)
--- a/src/core.js
+++ b/src/core.js
@@ -7,7 +7,7 @@ define([
        "./var/class2type",
        "./var/toString",
        "./var/hasOwn",
-       "./var/support"
+       "./core/support"
 ], function( arr, slice, concat, push, indexOf, class2type, toString, hasOwn, support ) {
 
 var

diff --git a/src/core/parseHTML.js b/src/core/parseHTML.js
index 808d60e3dc4f052fe8e2248c529896d27fcf981b..54016a4c1c5d5c8d7bc7ee8281f504ca1a1613e8 100644 (file)
--- a/src/core/parseHTML.js
+++ b/src/core/parseHTML.js
@@ -2,7 +2,7 @@ define([
        "../core",
        "./var/rsingleTag",
        "../manipulation" // buildFragment
-], function( jQuery, rsingleTag ) {
+], function( jQuery, rsingleTag, support ) {
 
 // data: string of html
 // context (optional): If specified, the fragment will be created in this context,
@@ -16,7 +16,11 @@ jQuery.parseHTML = function( data, context, keepScripts ) {
                keepScripts = context;
                context = false;
        }
-       context = context || document;
+       // document.implementation stops scripts or inline event handlers from
+       // being executed immediately
+       context = context || ( support.createHTMLDocument ?
+               document.implementation.createHTMLDocument() :
+               document );
 
        var parsed = rsingleTag.exec( data ),
                scripts = !keepScripts && [];

diff --git a/src/core/support.js b/src/core/support.js
new file mode 100644 (file)
index 0000000..fe3d6c2
--- /dev/null
+++ b/src/core/support.js
@@ -0,0 +1,6 @@
+define([
+       "../var/support"
+], function( jQuery, support ) {
+       // window.document is used here as it's before the sandboxed document
+       support.createHTMLDocument = !!window.document.implementation.createHTMLDocument;
+});

diff --git a/test/unit/core.js b/test/unit/core.js
index 66c02ac57027a3a5bb37351a3da6d33b0481aeab..783a7462ed545c80f1607b305bf135b86021c575 100644 (file)
--- a/test/unit/core.js
+++ b/test/unit/core.js
@@ -1367,6 +1367,24 @@ test("jQuery.parseHTML", function() {
        ok( jQuery.parseHTML("<#if><tr><p>This is a test.</p></tr><#/if>") || true, "Garbage input should not cause error" );
 });
 
+// This XSS test is optional, as it will only pass when `document.implementation.createHTMLDocument`
+// is implemented. This might not be the case for older Android browsers (<= 2.x).
+if ( document.implementation.createHTMLDocument ) {
+       asyncTest("jQuery.parseHTML", function() {
+               expect ( 1 );
+
+               Globals.register("parseHTMLError");
+
+               jQuery.globalEval("parseHTMLError = false;");
+               jQuery.parseHTML( "<img src=x onerror='parseHTMLError = true'>" );
+
+               window.setTimeout(function() {
+                       start();
+                       equal( window.parseHTMLError, false, "onerror eventhandler has not been called." );
+               }, 2000);
+       });
+}
+
 test("jQuery.parseJSON", function() {
        expect( 20 );
 

diff --git a/test/unit/support.js b/test/unit/support.js
index 11f15a33b4ce87dc39bb5a45ca862060322308ae..bed2c04144935de027c03c2e9cc240353e840d29 100644 (file)
--- a/test/unit/support.js
+++ b/test/unit/support.js
@@ -61,6 +61,7 @@ testIframeWithCallback( "Check CSP (https://developer.mozilla.org/en-US/docs/Sec
                        "checkOn": true,
                        "clearCloneStyle": true,
                        "cors": true,
+                       "createHTMLDocument": true,
                        "focusinBubbles": false,
                        "noCloneChecked": true,
                        "optDisabled": true,
@@ -77,6 +78,7 @@ testIframeWithCallback( "Check CSP (https://developer.mozilla.org/en-US/docs/Sec
                        "checkOn": true,
                        "clearCloneStyle": false,
                        "cors": true,
+                       "createHTMLDocument": true,
                        "focusinBubbles": true,
                        "noCloneChecked": false,
                        "optDisabled": true,
@@ -93,6 +95,7 @@ testIframeWithCallback( "Check CSP (https://developer.mozilla.org/en-US/docs/Sec
                        "checkOn": true,
                        "clearCloneStyle": false,
                        "cors": false,
+                       "createHTMLDocument": true,
                        "focusinBubbles": true,
                        "noCloneChecked": false,
                        "optDisabled": true,
@@ -109,6 +112,7 @@ testIframeWithCallback( "Check CSP (https://developer.mozilla.org/en-US/docs/Sec
                        "checkOn": true,
                        "clearCloneStyle": true,
                        "cors": true,
+                       "createHTMLDocument": true,
                        "focusinBubbles": false,
                        "noCloneChecked": true,
                        "optDisabled": true,
@@ -125,6 +129,7 @@ testIframeWithCallback( "Check CSP (https://developer.mozilla.org/en-US/docs/Sec
                        "checkOn": true,
                        "clearCloneStyle": true,
                        "cors": true,
+                       "createHTMLDocument": true,
                        "focusinBubbles": false,
                        "noCloneChecked": true,
                        "optDisabled": true,
@@ -141,6 +146,7 @@ testIframeWithCallback( "Check CSP (https://developer.mozilla.org/en-US/docs/Sec
                        "checkOn": true,
                        "clearCloneStyle": true,
                        "cors": true,
+                       "createHTMLDocument": true,
                        "focusinBubbles": false,
                        "noCloneChecked": true,
                        "optDisabled": true,
@@ -157,6 +163,7 @@ testIframeWithCallback( "Check CSP (https://developer.mozilla.org/en-US/docs/Sec
                        "checkOn": false,
                        "clearCloneStyle": true,
                        "cors": true,
+                       "createHTMLDocument": true,
                        "focusinBubbles": false,
                        "noCloneChecked": true,
                        "optDisabled": true,
@@ -173,6 +180,7 @@ testIframeWithCallback( "Check CSP (https://developer.mozilla.org/en-US/docs/Sec
                        "checkOn": false,
                        "clearCloneStyle": false,
                        "cors": true,
+                       "createHTMLDocument": true,
                        "focusinBubbles": false,
                        "noCloneChecked": true,
                        "optDisabled": false,