aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* CSS: Trim whitespace surrounding CSS Custom Properties valuesfecore12021-09-238-13/+43
| | | | | | | | The spec has recently changed and CSS Custom Properties values are trimmed now. This change makes jQuery polyfill that new behavior for all browsers. Ref w3c/csswg-drafts#774 Fixes gh-4926 Closes gh-4930
* Docs: update irc to Libera and fix LAMP dead linkfecore12021-09-051-2/+2
|
* Manipulation: Don't remove HTML comments from scriptsMichał Gołębiowski-Owczarek2021-07-193-12/+22
| | | | | | | | | | | | | | | | | | | When evaluating scripts, jQuery strips out the possible wrapping HTML comment and a CDATA section. However, all supported browsers are already doing that when loading JS via appending a script tag to the DOM which is how we've been doing `jQuery.globalEval` since jQuery 3.0.0. jQuery logic was imperfect, e.g. it just stripped the `<!--` and `-->` markers, respectively at the beginning or the end of the script contents. However, browsers are also stripping everything following those markers in the same line, treating them as single-line comments delimiters; this is now also mandated by ECMAScript 2015 in Annex B. Instead of fixing the jQuery logic, just let the browser do its thing. We also used to strip CDATA sections. However, this shouldn't be needed as in XML documents they're already not visible when inspecting element contents and in HTML documents they have no meaning. We've preserved that behavior for backwards compatibility in 3.x but we're removing it for 4.0. Fixes gh-4904 Closes gh-4906
* Build: Test on Node.js 16 instead of 15Michał Gołębiowski-Owczarek2021-07-121-2/+2
| | | | | | Node.js 10 is kept for now despite being EOL'd as that's what our current infrastructure relies on. Closes gh-4902
* Tests: Switch background image from online file to local 1x1.jpgTimo Tijhof2021-05-242-19/+9
| | | | | Also, remove unused `expected` property in `css` test cases. Closes gh-4866
* Event: Don't break focus triggering after `.on(focus).off(focus)`Michał Gołębiowski-Owczarek2021-05-102-4/+20
| | | | | | | | | | | | | | | | | | | The `_default` function in the special event settings for focus/blur has always returned `true` since gh-4813 as the event was already being fired from `leverageNative`. However, that only works if there's an active handler on that element; this made a quick consecutive call: ```js elem.on( "focus", function() {} ).off( "focus" ); ``` make subsequent `.trigger( "focus" )` calls to not do any triggering. The solution, already used in a similar `_default` method for the `click` event, is to check for the `dataPriv` entry on the element for the focus event (similarly for blur). Fixes gh-4867 Closes gh-4885
* Tests: Strip untypical callback parameter characters from mock.phpMichał Gołębiowski-Owczarek2021-04-132-13/+24
| | | | | | | | | | | Only allow alphanumeric characters & underscores for callback parameters. The change is done both for the PHP server as well as the Node.js-based version. This is only test code so we're not fixing any security issue but it happens often enough that the whole jQuery repository directory structure is deployed onto the server with PHP enabled that it makes is easy to introduce security issues if this cleanup is not done. Ref gh-4764 Closes gh-4871
* Tests: Make more tests run natively in Chrome & FirefoxMichał Gołębiowski-Owczarek2021-04-131-9/+9
| | | | | | | Chrome & Firefox now support complex `:not()` selectors so those test can run in them even without custom jQuery selector code. In the past, it was only possible in Safari, now we only need to exclude IE. Closes gh-4864
* Build: Take core-js-bundle from the external directory as wellMichał Gołębiowski-Owczarek2021-04-132-1/+4
| | | | | | | That package was missed in gh-4865 as it only broke browsers needing the polyfill which is just IE at the moment. Thus, it broke Core tests in IE only. Ref gh-4865 Closes gh-4870
* Build: Restore the external directoryMichał Gołębiowski-Owczarek2021-03-247-11/+34
| | | | | | | | | | | | In gh-4466, we removed the `external` directory in favor of loading some files directly from `node_modules`. This works fine locally but when deploying code for tests, this makes it impossible to not deploy `node_modules` as well. To avoid the issue, this change restores usage of the `external` directory. One change is that we no longer commit this directory to the repository, its only purpose is to have clear isolation from `node_modules`. Ref gh-4466 Closess gh-4865
* Release: remove the need to install grunt globallyTimmy Willison2021-03-011-3/+3
|
* Release: upgrade release dependenciesTimmy Willison2021-03-011-4/+3
| | | | - Remove unused npm dependency
* Support: ensure display is set to block for the support divTimmy Willison2021-02-171-0/+9
| | | | | | | | | | * Support: ensure display is set to block for the support div - Fixes an issue with the support test in iframes in Android 8 Chrome 86+, where display: inline resulted in unexpected height values. Close gh-4845 Fixes gh-4832
* Build: Rename master to main across the repositoryMichał Gołębiowski-Owczarek2021-02-055-13/+13
| | | | | | The default branch was updated, this updates the remaining occurrences in code & comments. Closes gh-4838
* Ajax: Don't auto-execute scripts unless dataType providedMichał Gołębiowski-Owczarek2021-01-262-59/+25
| | | | | | | | | | | | | | PR gh-2588 made jQuery stop auto-execute cross-domain scripts unless `dataType: "script"` was explicitly provided; this change landed in jQuery 3.0.0. This change extends that logic same-domain scripts as well. After this change, to request a script under a provided URL to be evaluated, you need to provide `dataType: "script` in `jQuery.ajax` options or to use `jQuery.getScript`. Fixes gh-4822 Closes gh-4825 Ref gh-2432 Ref gh-2588
* Deferred: Rename master to primaryMichał Gołębiowski-Owczarek2021-01-121-8/+8
| | | Closes gh-4828
* Tests: Fix tests for not auto-executing scripts without dataTypeMichał Gołębiowski-Owczarek2021-01-112-2/+2
| | | | | | | | | | | | | Two issues are fixed in testing for responses with a script Content-Type not getting auto-executed unless an explicit `dataType: "script"` is provided: * the test is now using a correct "text/javascript" Content-Type; it was using "text/html" until now which doesn't really check if the fix works * the Node.js based version of the tests didn't account for an empty `header` query string parameter Closes gh-4824 Ref gh-2432 Ref gh-2588 Ref 39cdb8c9aa0fde68f733553ba050a2ba9d86474c
* Dimensions: Add offset prop fallback to FF for unreliable TR dimensionsTimmy Willison2021-01-114-26/+84
| | | | | | | | Firefox incorrectly (or perhaps correctly) includes table borders in computed dimensions, but they are the only one. Workaround this by testing for it and falling back to offset properties Fixes gh-4529 Closes gh-4808
* Core: Report browser errors in parseXMLMichał Gołębiowski-Owczarek2020-12-082-8/+36
| | | | Fixes gh-4784 Closes gh-4816
* Core: Make jQuery.isXMLDoc accept falsy inputMichał Gołębiowski-Owczarek2020-12-072-2/+12
| | | | Fixes gh-4782 Closes gh-4814
* Event: Make focus re-triggering not focus the original element backMichał Gołębiowski-Owczarek2020-12-072-0/+40
| | | | | | | | | | | | | | | | | | | | | | | | | | If during a focus handler another focus event is triggered: ```js elem1.on( "focus", function() { elem2.trigger( "focus" ); } ); ``` due to their synchronous nature everywhere outside of IE the hack added in gh-4279 to leverage native events causes the native `.focus()` method to be called last for the initial element, making it steal the focus back. Since the native method is already being called in `leverageNative`, we can skip that final call. This aligns with changes to the `_default` method for the `click` event that were added when `leverageNative` was introduced there. A side effect of this change is that now `focusin` will only propagate to the document for the last focused element. This is a change in behavior but it also aligns us better with how this works with native methods. Fixes gh-4382 Closes gh-4813 Ref gh-4279
* Build: Test on Node.js 15Michał Gołębiowski-Owczarek2020-11-111-6/+7
| | | | | Also, run browser tests on Node 14 instead of 12. Closes gh-4802
* Event: Don't crash if an element is removed on blurMichał Gołębiowski-Owczarek2020-10-192-1/+34
| | | | | | | | | | In Chrome, if an element having a `focusout` handler is blurred by clicking outside of it, it invokes the handler synchronously. If that handler calls `.remove()` on the element, the data is cleared, leaving private data undefined. We're reading a property from that data so we need to guard against this. Fixes gh-4417 Closes gh-4799
* Build: Explicitly exclude the queue module from the slim buildMichał Gołębiowski-Owczarek2020-09-281-1/+1
| | | | | | | | | | The queue module is not present in the slim build as it depends on deferred and our Gruntfile specifies excluding deferred should also exclude queue: https://github.com/jquery/jquery/blob/3.5.1/Gruntfile.js#L66 This commit makes this exclusion explicit so that the queue module never accidentally gets re-included in the slim build if it stopped importing from the deferred module directly. Closes gh-4793
* Core: Drop support for Edge Legacy (i.e. non-Chromium Microsoft Edge)Michał Gołębiowski-Owczarek2020-09-2224-244/+105
| | | | | | | | | | | | Drop support for Edge Legacy: the non-Chromium, EdgeHTML-based Microsoft Edge version. Also, restrict some workarounds that were applied unconditionally in all browsers to run only in IE now. This slightly increases the size but reduces the performance burden on modern browsers that don't need the workarounds. Also, clean up some comments & remove some obsolete workarounds. Fixes gh-4568 Closes gh-4792
* Manipulation: Respect script crossorigin attribute in DOM manipulation高灰2020-09-225-3/+63
| | | | | | Fixes gh-4542 Closes gh-4563 Co-authored-by: Michał Gołębiowski-Owczarek <m.goleb@gmail.com>
* Tests: Recognize callbacks with dots in the Node.js mock serverMichał Gołębiowski-Owczarek2020-09-021-1/+1
| | | | | | | | | | | | This aligns the Node.js server with the previous PHP one in sending `mock.php` as a callback if there's no `callback` parameter in the query string which is triggered by a recently added test. This prevents the request crashing on that Node.js server and printing a JS error: ``` TypeError: Cannot read property '1' of null ``` Closes gh-4764 Ref gh-4754
* Tests: Skip the "jQuery.ajax() on unload" test in SafariMichał Gołębiowski-Owczarek2020-09-021-1/+4
| | | | | | | | The test has been already skipped in Chrome as it dropped support for such requests and now Safari has joined the squad. This will resolve AJAX test errors we've had for a while in Safari 13 & iOS 13. Closes gh-4779
* Build: Make the import/no-unused-modules ESLint rule work in WebStormMichał Gołębiowski-Owczarek2020-09-021-1/+10
| | | | | | | | | | | | | | | | When run via WebStorm, the root path against which paths in the config of the `import/no-unused-modules` ESLint rule are resolved is the path where the ESLint config file that defines the rule lies, i.e. `src`. When run via the command line, it's usually the root folder of the jQuery repository. This pattern intends to catch both. Note that we cannot specify two patterns here: ```js [ "src/*.js", "*.js" ] ``` as they're analyzed individually and the rule crashes if a pattern cannot be matched. Closes gh-4777
* Attributes: Drop the `toggleClass(boolean|undefined)` signatureMichał Gołębiowski-Owczarek2020-09-012-62/+15
| | | | | | | The behavior of this signature is not intuitive, especially if classes are manipulated via other ways between `toggleClass` calls. Fixes gh-3388 Closes gh-4766
* Ajax: Make responseJSON work for erroneous same-domain JSONP requestsMichał Gołębiowski-Owczarek2020-09-011-5/+18
| | | | | | | | | | | | | | | | Don't use a script tag for JSONP requests unless for cross-domain requests or if scriptAttrs are provided. This makes the `responseJSON` property available in JSONP error callbacks. This fixes a regression from jQuery 3.5.0 introduced in gh-4379 which made erroneous script responses to not be executed to follow native behavior. The 3.x-stable branch doesn't need this fix as it doesn't use script tags for regular async requests. Closes gh-4778 Ref gh-4771 Ref gh-4773 Ref gh-4379
* Event: Remove the event.which shimMichał Gołębiowski-Owczarek2020-08-261-32/+2
| | | | | | | | All supported browsers implement this property by themselves. The shim was only needed for IE <9. Fixes gh-3235 Closes gh-4765 Ref gh-4755
* Ajax: Execute JSONP error script responsesDallas Fraser2020-08-252-2/+17
| | | | | | | | | | | | Issue gh-4379 was meant to be a bug fix but the JSONP case is a bit special: under the hood it's a script but it simulates JSON responses in an environment without a CORS setup and sending JSON payloads on error responses is quite typical there. This commit makes JSONP error responses still execute the payload. The regular script error responses continue to be skipped. Fixes gh-4771 Closes gh-4773
* Ajax: Avoid CSP errors in the script transport for async requestsMichał Gołębiowski-Owczarek2020-08-257-9/+81
| | | | | | | | | | | | | | | | | Until now, the AJAX script transport only used a script tag to load scripts for cross-domain requests or ones with `scriptAttrs` set. This commit makes it also used for all async requests to avoid CSP errors arising from usage of inline scripts. This also makes `jQuery.getScript` not trigger CSP errors as it uses the AJAX script transport under the hood. For sync requests such a change is impossible and that's what `jQuery._evalUrl` uses. Fixing that is tracked in gh-1895. The commit also makes other type of requests using the script tag version of the script transport set its type to "GET", namely async scripts & ones with `scriptAttrs` set in addition to the existing cross-domain ones. Fixes gh-3969 Closes gh-4763
* Tests: Remove an unused local variableWonhyoung Park2020-08-131-2/+1
| | | Closes gh-4769
* Build: Append .eslintignore paths to grunt eslint pathsEd Sanders2020-07-271-5/+15
| | | | | | | This allows us to turn off the `quiet` option which was suppressing warnings. We can also set `maxWarnings` to 0 now that aren't any. Closes gh-4689
* Ajax: Drop the json to jsonp auto-promotion logicMichał Gołębiowski-Owczarek2020-07-274-52/+170
| | | | | | | | | | | | | | | | | | | | Previously, `jQuery.ajax` with `dataType: 'json'` with a provided callback was automatically converted to a jsonp request unless one also specified `jsonp: false`. Today the preferred way of interacting with a cross-domain backend is CORS which works in all browsers jQuery 4 will support. Auto-promoting JSON requests to JSONP ones introduces a security issue as the developer may be unaware they're not just downloading data but executing code from a remote domain. This commit disables the auto-promoting logic. BREAKING CHANGE: to trigger a JSONP request, it's now required to specify `dataType: "jsonp"`; previously some requests with `dataType: "json"` were auto-promoted to JSONP. Fixes gh-1799 Fixes gh-3376 Closes gh-4754
* Build: Use the US spelling of "favor"Necmettin Karakaya2020-07-223-3/+3
| | | Closes gh-4752
* Build: Fix commitplease husky configBeatriz Rezener2020-07-201-1/+1
| | | | Fixes gh-4735 Closes gh-4737
* Build: Update dependenciesMichał Gołębiowski-Owczarek2020-07-151-24/+24
| | | | | | This also resolves a security warning from GitHub about a vulnerable `request` version - the new `testswarm` package version depends on a fixed `request`. Closes gh-4732
* build: set up periodic code scanning analysisTimmy Willison2020-06-251-0/+51
|
* Manipulation: Avoid concatenating strings in buildFragmentMichał Gołębiowski-Owczarek2020-06-103-13/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Concatenating HTML strings in buildFragment is a possible security risk as it creates an opportunity of escaping the concatenated wrapper. It also makes it impossible to support secure HTML wrappers like [trusted types](https://web.dev/trusted-types/). It's safer to create wrapper elements using `document.createElement` & `appendChild`. The previous way was needed in jQuery <4 because IE <10 doesn't accept table parts set via `innerHTML`, even if the element which contents are set is a proper table element, e.g.: ```js tr.innerHTML = "<td></td>"; ``` The whole structure needs to be passed in one HTML string. jQuery 4 drops support for IE <11 so this is no longer an issue; in older version we'd have to duplicate the code paths. IE <10 needed to have `<option>` elements wrapped in `<select multiple="multiple">` but we no longer need that on master which makes the `document.createElement` way shorter as we don't have to call `setAttribute`. All these improvements, apart from making logic more secure, decrease the gzipped size by 58 bytes. Closes gh-4724 Ref gh-4409 Ref angular/angular.js#17028 Co-authored-by: Richard Gibson <richard.gibson@gmail.com>
* Docs: Update Frequently Reported Issues in the GitHub issue templateMichał Gołębiowski-Owczarek2020-06-081-1/+1
| | | | | | | | | | The issue about selectors with '#' being broken is old and no longer frequently reported so this commit removes it from the list. On the other hand, we're now getting lots of reports about the security fix in jQuery 3.5.0 that was also a breaking change: gh-4642. This one is now mentioned in the list. Closes gh-4728 Ref gh-4642
* Build:Event: Make sure all source modules' exports are used (#4648)Michał Gołębiowski-Owczarek2020-06-027-9/+5
| | | | | | | To achieve that, use `eslint-plugin-import`'s `no-unused-modules` rule. Also, explicitly import `event/trigger.js` from `jquery.js`; so far it was only imported from ajax.js, making it mistakenly skipped in the `custom:slim,-deprecated` build.
* Deprecated: Remove jQuery.trimMichał Gołębiowski-Owczarek2020-05-183-28/+0
| | | | | | The API has been deprecated in 3.5.0 so it can be removed in 4.0.0. Ref gh-4461 Closes gh-4695
* Release: Remove an unused chalk dependencyMichał Gołębiowski-Owczarek2020-05-181-2/+1
| | | | | Chalk was used for a Sizzle version check that's no longer there on `master`. Closes gh-4712
* Build: Update eslint-config-jquery, fix linting violationsMichał Gołębiowski-Owczarek2020-05-1811-11/+11
| | | | | Closes gh-4696 Ref jquery/eslint-config-jquery#15 Ref jquery/eslint-config-jquery#16
* Tests: Remove remaining obsolete jQuery.cache referencesMichał Gołębiowski-Owczarek2020-05-182-36/+3
| | | | | | PR gh-4586 removed some of those but not all. Closes gh-4715 Ref gh-4586
* Docs: Change JS Foundation mentions to OpenJS FoundationMichał Gołębiowski-Owczarek2020-05-185-6/+6
| | | Closes gh-4711
* Docs: add SECURITY.md, show security email addressTimmy Willison2020-05-121-0/+12
|
generated by cgit v1.2.3 (git 2.39.1) at 2025-05-01 04:56:15 +0000