Attributes: Don't stringify attributes in the setter

Stringifying attributes in the setter was needed for IE <=9 but it breaks
trusted types enforcement when setting a script `src` attribute.

Note that this doesn't mean script execution works. Since jQuery disables all
scripts by changing their type and then executes them by creating fresh script
tags with proper `src` & possibly other attributes, this unwraps any trusted
`src` wrappers, making the script not execute under strict CSP settings.
We might try to fix it in the future in a separate change.

Fixes gh-4948
Closes gh-4949

1 files changed, 1 insertions, 1 deletions

diff --git a/src/attributes/attr.js b/src/attributes/attr.js
index 2773a383c..d6d497735 100644
--- a/src/attributes/attr.js
+++ b/src/attributes/attr.js
@@ -50,7 +50,7 @@ jQuery.extend( {
 				return ret;
 			}
 
-			elem.setAttribute( name, value + "" );
+			elem.setAttribute( name, value );
 			return value;
 		}