aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorOleg Gaidarenko <markelog@gmail.com>2015-09-10 13:40:00 +0300
committerOleg Gaidarenko <markelog@gmail.com>2015-10-12 17:05:49 +0300
commitf60729f3903d17917dc351f3ac87794de379b0cc (patch)
tree7bb2189bb9c963d835b95a3f2726e84102e12263
parent5da5035039c48fd00e3effa5135e257ccda79454 (diff)
downloadjquery-f60729f3903d17917dc351f3ac87794de379b0cc.tar.gz
jquery-f60729f3903d17917dc351f3ac87794de379b0cc.zip
Ajax: Mitigate possible XSS vulnerability
Proposed by @jaubourg Cherry-picked from b078a62013782c7424a4a61a240c23c4c0b42614 Fixes gh-2432 Closes gh-2588
-rw-r--r--src/ajax/script.js7
-rw-r--r--test/unit/ajax.js48
2 files changed, 55 insertions, 0 deletions
diff --git a/src/ajax/script.js b/src/ajax/script.js
index 4c810f0a0..d94177432 100644
--- a/src/ajax/script.js
+++ b/src/ajax/script.js
@@ -4,6 +4,13 @@ define( [
"../ajax"
], function( jQuery, document ) {
+// Prevent auto-execution of scripts when no explicit dataType was provided (See gh-2432)
+jQuery.ajaxPrefilter( function( s ) {
+ if ( s.crossDomain ) {
+ s.contents.script = false;
+ }
+} );
+
// Install script dataType
jQuery.ajaxSetup( {
accepts: {
diff --git a/test/unit/ajax.js b/test/unit/ajax.js
index 4d9b1bc49..6c78618f4 100644
--- a/test/unit/ajax.js
+++ b/test/unit/ajax.js
@@ -85,6 +85,54 @@ QUnit.module( "ajax", {
};
} );
+ ajaxTest( "jQuery.ajax() - do not execute js (crossOrigin)", 2, function( assert ) {
+ return {
+ create: function( options ) {
+ options.crossDomain = true;
+ return jQuery.ajax( url( "data/script.php?header=ecma" ), options );
+ },
+ success: function() {
+ assert.ok( true, "success" );
+ },
+ complete: function() {
+ assert.ok( true, "complete" );
+ }
+ };
+ } );
+
+ ajaxTest( "jQuery.ajax() - execute js for crossOrigin when dataType option is provided", 3,
+ function( assert ) {
+ return {
+ create: function( options ) {
+ options.crossDomain = true;
+ options.dataType = "script";
+ return jQuery.ajax( url( "data/script.php?header=ecma" ), options );
+ },
+ success: function() {
+ assert.ok( true, "success" );
+ },
+ complete: function() {
+ assert.ok( true, "complete" );
+ }
+ };
+ }
+ );
+
+ ajaxTest( "jQuery.ajax() - do not execute js (crossOrigin)", 2, function( assert ) {
+ return {
+ create: function( options ) {
+ options.crossDomain = true;
+ return jQuery.ajax( url( "data/script.php" ), options );
+ },
+ success: function() {
+ assert.ok( true, "success" );
+ },
+ complete: function() {
+ assert.ok( true, "complete" );
+ }
+ };
+ } );
+
ajaxTest( "jQuery.ajax() - success callbacks (late binding)", 8, function( assert ) {
return {
setup: addGlobalEvents( "ajaxStart ajaxStop ajaxSend ajaxComplete ajaxSuccess", assert ),