Revert "Adjust jQuery('html') detection to only match when html starts with '<' ...

This reverts commit 239fc86b01d52fd9df6d1963027ed37b4f6251fc.

The consensus is that this would change behavior too abruptly. We will warn in 1.8 and do this in 1.9.

diff --git a/src/core.js b/src/core.js
index 14a6539161e85bccab8418e026955a90c1e3272a..1bf7e56039e73653ce9cc4f413a8c6cd7e810c7f 100644 (file)
--- a/src/core.js
+++ b/src/core.js
@@ -40,8 +40,9 @@ var
        trimRight = /\s+$/,
 
        // A simple way to check for HTML strings
-       // If starts-with '<'
-       rhtmlString = /^\s*(<[\w\W]+>)[^>]*$/,
+       // Prioritize #id over <tag> to avoid XSS via location.hash (#9521)
+       // Ignore html if within quotes "" '' or brackets/parens [] ()
+       rhtmlString = /^(?:[^#<\\]*(<[\w\W]+>)(?![^\[]*\])(?![^\(]*\))(?![^']*')(?![^"]*")[^>]*$)/,
 
        // Match a standalone tag
        rsingleTag = /^<(\w+)\s*\/?>(?:<\/\1>)?$/,

diff --git a/test/unit/core.js b/test/unit/core.js
index 200f045dbec7b8011d87cf9dd8af4ef4627b6c44..0b392adf199bbb3cb9652b85649d62ccda9f677b 100644 (file)
--- a/test/unit/core.js
+++ b/test/unit/core.js
@@ -27,7 +27,7 @@ test("jQuery()", function() {
                div = jQuery("<div/><hr/><code/><b/>"),
                exec = false,
                long = "",
-               expected = 24,
+               expected = 26,
                attrObj = {
                        click: function() { ok( exec, "Click executed." ); },
                        text: "test",
@@ -132,12 +132,14 @@ test("jQuery()", function() {
        elem.remove();
 
        equal( jQuery(" <div/> ").length, 1, "Make sure whitespace is trimmed." );
+       equal( jQuery(" a<div/>b ").length, 1, "Make sure whitespace and other characters are trimmed." );
 
        for ( i = 0; i < 128; i++ ) {
                long += "12345678";
        }
 
        equal( jQuery(" <div>" + long + "</div> ").length, 1, "Make sure whitespace is trimmed on long strings." );
+       equal( jQuery(" a<div>" + long + "</div>b ").length, 1, "Make sure whitespace and other characters are trimmed on long strings." );
 });
 
 test("selector state", function() {