diff options
| author | buddh4 <mail@jharrer.de> | 2019-03-19 22:40:30 +0100 |
|---|---|---|
| committer | Michał Gołębiowski-Owczarek <m.goleb@gmail.com> | 2019-03-25 18:14:24 +0100 |
| commit | 005040379d8b64aacbe54941d878efa6e86df1cc (patch) | |
| tree | 158b1b84fcddcb4271aa5df2955ec017aca6e4e9 /src | |
| parent | fe5f04de8fde9c69ed48283b99280aa6df3795c7 (diff) | |
| download | jquery-005040379d8b64aacbe54941d878efa6e86df1cc.tar.gz jquery-005040379d8b64aacbe54941d878efa6e86df1cc.zip | |
Core: Preserve CSP nonce on scripts with src attribute in DOM manipulation
Fixes gh-4323
Closes gh-4328
Diffstat (limited to 'src')
| -rw-r--r-- | src/manipulation.js | 4 | ||||
| -rw-r--r-- | src/manipulation/_evalUrl.js | 4 |
2 files changed, 5 insertions, 3 deletions
diff --git a/src/manipulation.js b/src/manipulation.js index 7dbc92689..ab19d8b3c 100644 --- a/src/manipulation.js +++ b/src/manipulation.js @@ -199,7 +199,9 @@ function domManip( collection, args, callback, ignored ) { // Optional AJAX dependency, but won't run scripts if not present if ( jQuery._evalUrl && !node.noModule ) { - jQuery._evalUrl( node.src ); + jQuery._evalUrl( node.src, { + nonce: node.nonce || node.getAttribute( "nonce" ) + } ); } } else { DOMEval( node.textContent.replace( rcleanScript, "" ), node, doc ); diff --git a/src/manipulation/_evalUrl.js b/src/manipulation/_evalUrl.js index e20995a89..9a4d2ac6f 100644 --- a/src/manipulation/_evalUrl.js +++ b/src/manipulation/_evalUrl.js @@ -4,7 +4,7 @@ define( [ "use strict"; -jQuery._evalUrl = function( url ) { +jQuery._evalUrl = function( url, options ) { return jQuery.ajax( { url: url, @@ -22,7 +22,7 @@ jQuery._evalUrl = function( url ) { "text script": function() {} }, dataFilter: function( response ) { - jQuery.globalEval( response ); + jQuery.globalEval( response, options ); } } ); }; |