From 239169bb2ede6ea6287d82d1d13b0c354f451749 Mon Sep 17 00:00:00 2001
From: Oleg Gaidarenko <markelog@gmail.com>
Date: Mon, 12 Oct 2015 19:56:46 +0300
Subject: [PATCH] Ajax: improve content-type detection

Fixes gh-2584
Closes gh-2643
---
 src/ajax.js                     |   6 +-
 src/ajax/script.js              |   2 +-
 test/data/ajax/content-type.php |   5 ++
 test/unit/ajax.js               | 104 +++++++++++++++++++++++++++++++-
 4 files changed, 112 insertions(+), 5 deletions(-)
 create mode 100644 test/data/ajax/content-type.php

diff --git a/src/ajax.js b/src/ajax.js
index 157934ef1..efc413650 100644
--- a/src/ajax.js
+++ b/src/ajax.js
@@ -322,9 +322,9 @@ jQuery.extend( {
 		},
 
 		contents: {
-			xml: /xml/,
-			html: /html/,
-			json: /json/
+			xml: /\bxml\b/,
+			html: /\bhtml/,
+			json: /\bjson\b/
 		},
 
 		responseFields: {
diff --git a/src/ajax/script.js b/src/ajax/script.js
index 3978ba46c..485ba397b 100644
--- a/src/ajax/script.js
+++ b/src/ajax/script.js
@@ -18,7 +18,7 @@ jQuery.ajaxSetup( {
 			"application/ecmascript, application/x-ecmascript"
 	},
 	contents: {
-		script: /(?:java|ecma)script/
+		script: /\b(?:java|ecma)script\b/
 	},
 	converters: {
 		"text script": function( text ) {
diff --git a/test/data/ajax/content-type.php b/test/data/ajax/content-type.php
new file mode 100644
index 000000000..162e3636d
--- /dev/null
+++ b/test/data/ajax/content-type.php
@@ -0,0 +1,5 @@
+<?php
+	$type = $_REQUEST['content-type'];
+	header("Content-type: $type");
+	echo $_REQUEST['response']
+?>
diff --git a/test/unit/ajax.js b/test/unit/ajax.js
index 647958773..ec3e07613 100644
--- a/test/unit/ajax.js
+++ b/test/unit/ajax.js
@@ -1794,7 +1794,109 @@ QUnit.module( "ajax", {
 		}
 	);
 
-// //----------- jQuery.ajaxPrefilter()
+	ajaxTest( "gh-2587 - when content-type not xml, but looks like one", 1, function( assert ) {
+		return {
+			url: url( "data/ajax/content-type.php" ),
+			data: {
+				"content-type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+				"response": "<test/>"
+			},
+			success: function( result ) {
+				assert.strictEqual(
+					typeof result,
+					"string",
+					"Should handle it as a string, not xml"
+				);
+			}
+		};
+	} );
+
+	ajaxTest( "gh-2587 - when content-type not xml, but looks like one", 1, function( assert ) {
+		return {
+			url: url( "data/ajax/content-type.php" ),
+			data: {
+				"content-type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+				"response": "<test/>"
+			},
+			success: function( result ) {
+				assert.strictEqual(
+					typeof result,
+					"string",
+					"Should handle it as a string, not xml"
+				);
+			}
+		};
+	} );
+
+	ajaxTest( "gh-2587 - when content-type not json, but looks like one", 1, function( assert ) {
+		return {
+			url: url( "data/ajax/content-type.php" ),
+			data: {
+				"content-type": "test/jsontest",
+				"response": JSON.stringify({test: "test"})
+			},
+			success: function( result ) {
+				assert.strictEqual(
+					typeof result,
+					"string",
+					"Should handle it as a string, not json"
+				);
+			}
+		};
+	} );
+
+	ajaxTest( "gh-2587 - when content-type not html, but looks like one", 1, function( assert ) {
+		return {
+			url: url( "data/ajax/content-type.php" ),
+			data: {
+				"content-type": "test/htmltest",
+				"response": "<p>test</p>"
+			},
+			success: function( result ) {
+				assert.strictEqual(
+					typeof result,
+					"string",
+					"Should handle it as a string, not html"
+				);
+			}
+		};
+	} );
+
+	ajaxTest( "gh-2587 - when content-type not javascript, but looks like one", 1, function( assert ) {
+		return {
+			url: url( "data/ajax/content-type.php" ),
+			data: {
+				"content-type": "test/testjavascript",
+				"response": "alert(1)"
+			},
+			success: function( result ) {
+				assert.strictEqual(
+					typeof result,
+					"string",
+					"Should handle it as a string, not javascript"
+				);
+			}
+		};
+	} );
+
+	ajaxTest( "gh-2587 - when content-type not ecmascript, but looks like one", 1, function( assert ) {
+		return {
+			url: url( "data/ajax/content-type.php" ),
+			data: {
+				"content-type": "test/testjavascript",
+				"response": "alert(1)"
+			},
+			success: function( result ) {
+				assert.strictEqual(
+					typeof result,
+					"string",
+					"Should handle it as a string, not ecmascript"
+				);
+			}
+		};
+	} );
+
+//----------- jQuery.ajaxPrefilter()
 
 	ajaxTest( "jQuery.ajaxPrefilter() - abort", 1, function( assert ) {
 		return {
-- 
2.39.5