Prioritize #id over <tag> to avoid XSS via location.hash (#9521)

diff --git a/src/core.js b/src/core.js
index 694f884d68d7a0f1db9b69c699e1f6aed7769297..0b99b74a23e2a5b1861333a142325e1dc8e8319b 100644 (file)
--- a/src/core.js
+++ b/src/core.js
@@ -16,8 +16,8 @@ var jQuery = function( selector, context ) {
        rootjQuery,
 
        // A simple way to check for HTML strings or ID strings
-       // (both of which we optimize for)
-       quickExpr = /^(?:[^<]*(<[\w\W]+>)[^>]*$|#([\w\-]*)$)/,
+       // Prioritize #id over <tag> to avoid XSS via location.hash (#9521)
+       quickExpr = /^(?:[^#<]*(<[\w\W]+>)[^>]*$|#([\w\-]*)$)/,
 
        // Check if a string has a non-whitespace character in it
        rnotwhite = /\S/,

diff --git a/test/unit/core.js b/test/unit/core.js
index d47920501118c0d4175f3fbe587e65b0794c9244..40ee80f6a31a51a9521409c66fc616259473c979 100644 (file)
--- a/test/unit/core.js
+++ b/test/unit/core.js
@@ -467,6 +467,24 @@ test("isXMLDoc - HTML", function() {
        document.body.removeChild( iframe );
 });
 
+test("XSS via location.hash", function() {
+       expect(1);
+       
+       stop();
+       jQuery._check9521 = function(x){
+               ok( x, "script called from #id-like selector with inline handler" );
+               jQuery("#check9521").remove();
+               delete jQuery._check9521;
+               start();
+       };
+       try {
+               // This throws an error because it's processed like an id
+               jQuery( '#<img id="check9521" src="no-such-.gif" onerror="jQuery._check9521(false)">' ).appendTo("#qunit-fixture");
+       } catch (err) {
+               jQuery._check9521(true);
+       };
+});
+
 if ( !isLocal ) {
 test("isXMLDoc - XML", function() {
        expect(3);