]> source.dussan.org Git - jquery.git/commitdiff
projects / jquery.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: ba2a8fb)
Fix #14422 and add more thorough check for CSP violations
authorOleg <markelog@gmail.com>
Wed, 30 Oct 2013 12:20:38 +0000 (16:20 +0400)
committerOleg <markelog@gmail.com>
Thu, 7 Nov 2013 21:08:50 +0000 (22:08 +0100)
Close gh-1413

src/event/support.js patch | blob | history
test/data/support/csp-clean.php [new file with mode: 0644] patch | blob
test/data/support/csp-log.php [new file with mode: 0644] patch | blob
test/data/support/csp.log [new file with mode: 0755] patch | blob
test/data/support/csp.php patch | blob | history
test/unit/support.js patch | blob | history

diff --git a/src/event/support.js b/src/event/support.js
index 1912b8430bc7a0e163fdc3dc75960cb2ab54efd7..d2a092250a704f2ff8711124d9ca77f286efdaf0 100644 (file)
--- a/src/event/support.js
+++ b/src/event/support.js
@@ -4,14 +4,17 @@ define([
 
 (function () {
        var i, eventName,
-               div = document.createElement("div" );
+               div = document.createElement( "div" );
 
-       // Support: IE<9 (lack submit/change bubble), Firefox 17+ (lack focusin event)
-       // Beware of CSP restrictions (https://developer.mozilla.org/en/Security/CSP)
+       // Support: IE<9 (lack submit/change bubble), Firefox 23+ (lack focusin event)
        for ( i in { submit: true, change: true, focusin: true }) {
-               div.setAttribute( eventName = "on" + i, "t" );
+               eventName = "on" + i;
 
-               support[ i + "Bubbles" ] = eventName in window || div.attributes[ eventName ].expando === false;
+               if ( !(support[ i + "Bubbles" ] = eventName in window) ) {
+                       // Beware of CSP restrictions (https://developer.mozilla.org/en/Security/CSP)
+                       div.setAttribute( eventName, "t" );
+                       support[ i + "Bubbles" ] = div.attributes[ eventName ].expando === false;
+               }
        }
 
        // Null elements to avoid leaks in IE.
diff --git a/test/data/support/csp-clean.php b/test/data/support/csp-clean.php
new file mode 100644 (file)
index 0000000..e16d047
--- /dev/null
+++ b/test/data/support/csp-clean.php
@@ -0,0 +1,3 @@
+<?php
+       file_put_contents("csp.log", "", LOCK_EX);
+?>
diff --git a/test/data/support/csp-log.php b/test/data/support/csp-log.php
new file mode 100644 (file)
index 0000000..efbb9d7
--- /dev/null
+++ b/test/data/support/csp-log.php
@@ -0,0 +1,3 @@
+<?php
+       file_put_contents("csp.log", "error", LOCK_EX);
+?>
diff --git a/test/data/support/csp.log b/test/data/support/csp.log
new file mode 100755 (executable)
index 0000000..e69de29
diff --git a/test/data/support/csp.php b/test/data/support/csp.php
index b21ce0f745039c48e4f078b6d7d07bc726b1aca0..d01def783f081194b902eaeb0ec3eb86a242bdbb 100644 (file)
--- a/test/data/support/csp.php
+++ b/test/data/support/csp.php
@@ -1,12 +1,7 @@
 <?php
-       # Support: Firefox
-       header("X-Content-Security-Policy: default-src 'self';");
-
-       # Support: Webkit, Safari 5
-       # http://stackoverflow.com/questions/13663302/why-does-my-content-security-policy-work-everywhere-but-safari
-       header("X-WebKit-CSP: script-src " . $_SERVER["HTTP_HOST"] . " 'self'");
-
-       header("Content-Security-Policy: default-src 'self'");
+       # This test page checkes CSP only for browsers with "Content-Security-Policy" header support
+       # i.e. no old WebKit or old Firefox
+       header("Content-Security-Policy: default-src 'self'; report-uri csp-log.php");
 ?>
 <!DOCTYPE html>
 <html>
diff --git a/test/unit/support.js b/test/unit/support.js
index a37f2c0225b529f3803fdea7a4a3cfc9e297937a..b87299d53c934ac2b2ab90295dc4a07236e49949 100644 (file)
--- a/test/unit/support.js
+++ b/test/unit/support.js
@@ -60,6 +60,24 @@ testIframeWithCallback( "box-sizing does not affect jQuery.support.shrinkWrapBlo
        strictEqual( shrinkWrapBlocks, computedSupport.shrinkWrapBlocks, "jQuery.support.shrinkWrapBlocks properties are the same" );
 });
 
+
+// This test checkes CSP only for browsers with "Content-Security-Policy" header support
+// i.e. no old WebKit or old Firefox
+testIframeWithCallback( "Check CSP (https://developer.mozilla.org/en-US/docs/Security/CSP) restrictions",
+       "support/csp.php",
+       function( support ) {
+               expect( 2 );
+               deepEqual( jQuery.extend( {}, support ), computedSupport, "No violations of CSP polices" );
+
+               stop();
+
+               supportjQuery.get( "data/support/csp.log" ).done(function( data ) {
+                       equal( data, "", "No log request should be sent" );
+                       supportjQuery.get( "data/support/csp-clean.php" ).done( start );
+               });
+       }
+);
+
 (function() {
        var expected, version,
                userAgent = window.navigator.userAgent;
@@ -462,17 +480,3 @@ testIframeWithCallback( "box-sizing does not affect jQuery.support.shrinkWrapBlo
        }
 
 })();
-
-// Support: Safari 5.1
-// Shameless browser-sniff, but Safari 5.1 mishandles CSP
-if ( !( typeof navigator !== "undefined" &&
-       (/ AppleWebKit\/\d.*? Version\/(\d+)/.exec(navigator.userAgent) || [])[1] < 6 ) ) {
-
-       testIframeWithCallback( "Check CSP (https://developer.mozilla.org/en-US/docs/Security/CSP) restrictions",
-               "support/csp.php",
-               function( support ) {
-                       expect( 1 );
-                       deepEqual( jQuery.extend( {}, support ), computedSupport, "No violations of CSP polices" );
-               }
-       );
-}
jQuery JavaScript Library: https://github.com/jquery/jquery