From 90a3c439828e21e291b65d4dfc1da6774d611aaa Mon Sep 17 00:00:00 2001
From: =?utf8?q?Micha=C5=82=20Go=C5=82=C4=99biowski-Owczarek?=
 <m.goleb@gmail.com>
Date: Thu, 29 Apr 2021 18:27:58 +0200
Subject: [PATCH] Tests: Strip untypical callback parameter characters from PHP
 files

Only allow alphanumeric characters & underscores for callback parameters.
This is only test code so we're not fixing any security issue but it happens
often enough that the whole jQuery repository directory structure is deployed
onto the server with PHP enabled that it makes is easy to introduce security
issues if this cleanup is not done.

This is a 1.x/2.x version of PR gh-4871.

The change doesn't require a release; it's meant at installations testing
the latest state of `1.12-stable` & `2.2-stable` branches.

This change also fixes testing on Travis & on Chrome/Firefox.

Closes gh-4875
Ref gh-4764
Ref gh-4871

(cherry picked from acb7c49c8d42f601fa347661b1118959079f6b52)
---
 .travis.yml                         |  9 +++++----
 test/data/jsonp.php                 | 13 +++++++------
 test/data/with_fries_over_jsonp.php |  6 +++++-
 test/unit/ajax.js                   | 22 ++++++++++++++--------
 test/unit/support.js                |  3 ++-
 5 files changed, 33 insertions(+), 20 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 34f4d9aec..be6208602 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,8 +1,9 @@
 language: node_js
-sudo: false
+os: linux
 node_js:
-- "0.10"
-- "0.12"
 - "4"
-- "5"
 - "6"
+- "8"
+- "10"
+- "12"
+- "14"
diff --git a/test/data/jsonp.php b/test/data/jsonp.php
index 6c13d72e9..51eee1c6f 100644
--- a/test/data/jsonp.php
+++ b/test/data/jsonp.php
@@ -1,14 +1,15 @@
 <?php
 error_reporting(0);
+function cleanCallback( $callback ) {
+	return preg_replace( '/[^a-z0-9_]/i', '', $callback );
+}
 $callback = $_REQUEST['callback'];
 if ( ! $callback ) {
 	$callback = explode("?",end(explode("/",$_SERVER['REQUEST_URI'])));
 	$callback = $callback[0];
 }
-$json = $_REQUEST['json'];
-if($json) {
-	echo $callback . '([ {"name": "John", "age": 21}, {"name": "Peter", "age": 25 } ])';
-} else {
-	echo $callback . '({ "data": {"lang": "en", "length": 25} })';
-}
+$json = $_REQUEST['json'] ?
+	'[ { "name": "John", "age": 21 }, { "name": "Peter", "age": 25 } ]' :
+	'{ "data": { "lang": "en", "length": 25 } }';
+echo cleanCallback( $callback ) . '(' . $json . ')';
 ?>
diff --git a/test/data/with_fries_over_jsonp.php b/test/data/with_fries_over_jsonp.php
index 456aeb3bd..7de47d125 100644
--- a/test/data/with_fries_over_jsonp.php
+++ b/test/data/with_fries_over_jsonp.php
@@ -1,7 +1,11 @@
 <?php
 error_reporting(0);
+function cleanCallback( $callback ) {
+	return preg_replace( '/[^a-z0-9_]/i', '', $callback );
+}
 $callback = $_REQUEST['callback'];
+$cleanCallback = cleanCallback( $callback );
 $json = $_REQUEST['json'];
 $text = json_encode(file_get_contents(dirname(__FILE__)."/with_fries.xml"));
-echo "$callback($text)";
+echo "$cleanCallback($text)\n";
 ?>
diff --git a/test/unit/ajax.js b/test/unit/ajax.js
index 19c0b7b4f..efe54ba6c 100644
--- a/test/unit/ajax.js
+++ b/test/unit/ajax.js
@@ -1519,14 +1519,20 @@ QUnit.module( "ajax", {
 		};
 	} );
 
-	testIframeWithCallback(
-		"#14379 - jQuery.ajax() on unload",
-		"ajax/onunload.html",
-		function( status, assert ) {
-			assert.expect( 1 );
-			assert.strictEqual( status, "success", "Request completed" );
-		}
-	);
+	// Chrome 78 dropped support for synchronous XHR requests inside of
+	// beforeunload, unload, pagehide, and visibilitychange event handlers.
+	// See https://bugs.chromium.org/p/chromium/issues/detail?id=952452
+	// Safari 13 did similar changes. The below check will catch them both.
+	if ( !/safari/i.test( navigator.userAgent ) ) {
+		testIframeWithCallback(
+			"#14379 - jQuery.ajax() on unload",
+			"ajax/onunload.html",
+			function( status, assert ) {
+				assert.expect( 1 );
+				assert.strictEqual( status, "success", "Request completed" );
+			}
+		);
+	}
 
 	// BrowserStack PATCH support sometimes breaks so on TestSwarm run the test in IE only.
 	// Unfortunately, all IE versions gets special treatment in request object creation
diff --git a/test/unit/support.js b/test/unit/support.js
index b490190e8..0461f4c43 100644
--- a/test/unit/support.js
+++ b/test/unit/support.js
@@ -577,6 +577,7 @@ testIframeWithCallback(
 			"tbody": true
 		};
 	} else if ( /firefox/i.test( userAgent ) ) {
+		version = userAgent.match( /firefox\/(\d+)/i )[ 1 ];
 		expected = {
 			"ajax": true,
 			"appendChecked": true,
@@ -610,7 +611,7 @@ testIframeWithCallback(
 			"radioValue": true,
 			"reliableHiddenOffsets": true,
 			"reliableMarginRight": true,
-			"reliableMarginLeft": false,
+			"reliableMarginLeft": version >= 61,
 			"shrinkWrapBlocks": false,
 			"style": true,
 			"submit": true,
-- 
2.39.5