aboutsummaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* Event: Remove the event.which shimMichał Gołębiowski-Owczarek2020-08-261-32/+2
| | | | | | | | All supported browsers implement this property by themselves. The shim was only needed for IE <9. Fixes gh-3235 Closes gh-4765 Ref gh-4755
* Ajax: Execute JSONP error script responsesDallas Fraser2020-08-251-2/+4
| | | | | | | | | | | | Issue gh-4379 was meant to be a bug fix but the JSONP case is a bit special: under the hood it's a script but it simulates JSON responses in an environment without a CORS setup and sending JSON payloads on error responses is quite typical there. This commit makes JSONP error responses still execute the payload. The regular script error responses continue to be skipped. Fixes gh-4771 Closes gh-4773
* Ajax: Avoid CSP errors in the script transport for async requestsMichał Gołębiowski-Owczarek2020-08-251-3/+7
| | | | | | | | | | | | | | | | | Until now, the AJAX script transport only used a script tag to load scripts for cross-domain requests or ones with `scriptAttrs` set. This commit makes it also used for all async requests to avoid CSP errors arising from usage of inline scripts. This also makes `jQuery.getScript` not trigger CSP errors as it uses the AJAX script transport under the hood. For sync requests such a change is impossible and that's what `jQuery._evalUrl` uses. Fixing that is tracked in gh-1895. The commit also makes other type of requests using the script tag version of the script transport set its type to "GET", namely async scripts & ones with `scriptAttrs` set in addition to the existing cross-domain ones. Fixes gh-3969 Closes gh-4763
* Ajax: Drop the json to jsonp auto-promotion logicMichał Gołębiowski-Owczarek2020-07-271-52/+48
| | | | | | | | | | | | | | | | | | | | Previously, `jQuery.ajax` with `dataType: 'json'` with a provided callback was automatically converted to a jsonp request unless one also specified `jsonp: false`. Today the preferred way of interacting with a cross-domain backend is CORS which works in all browsers jQuery 4 will support. Auto-promoting JSON requests to JSONP ones introduces a security issue as the developer may be unaware they're not just downloading data but executing code from a remote domain. This commit disables the auto-promoting logic. BREAKING CHANGE: to trigger a JSONP request, it's now required to specify `dataType: "jsonp"`; previously some requests with `dataType: "json"` were auto-promoted to JSONP. Fixes gh-1799 Fixes gh-3376 Closes gh-4754
* Manipulation: Avoid concatenating strings in buildFragmentMichał Gołębiowski-Owczarek2020-06-102-13/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Concatenating HTML strings in buildFragment is a possible security risk as it creates an opportunity of escaping the concatenated wrapper. It also makes it impossible to support secure HTML wrappers like [trusted types](https://web.dev/trusted-types/). It's safer to create wrapper elements using `document.createElement` & `appendChild`. The previous way was needed in jQuery <4 because IE <10 doesn't accept table parts set via `innerHTML`, even if the element which contents are set is a proper table element, e.g.: ```js tr.innerHTML = "<td></td>"; ``` The whole structure needs to be passed in one HTML string. jQuery 4 drops support for IE <11 so this is no longer an issue; in older version we'd have to duplicate the code paths. IE <10 needed to have `<option>` elements wrapped in `<select multiple="multiple">` but we no longer need that on master which makes the `document.createElement` way shorter as we don't have to call `setAttribute`. All these improvements, apart from making logic more secure, decrease the gzipped size by 58 bytes. Closes gh-4724 Ref gh-4409 Ref angular/angular.js#17028 Co-authored-by: Richard Gibson <richard.gibson@gmail.com>
* Build:Event: Make sure all source modules' exports are used (#4648)Michał Gołębiowski-Owczarek2020-06-027-9/+5
| | | | | | | To achieve that, use `eslint-plugin-import`'s `no-unused-modules` rule. Also, explicitly import `event/trigger.js` from `jquery.js`; so far it was only imported from ajax.js, making it mistakenly skipped in the `custom:slim,-deprecated` build.
* Deprecated: Remove jQuery.trimMichał Gołębiowski-Owczarek2020-05-182-6/+0
| | | | | | The API has been deprecated in 3.5.0 so it can be removed in 4.0.0. Ref gh-4461 Closes gh-4695
* Build: Update eslint-config-jquery, fix linting violationsMichał Gołębiowski-Owczarek2020-05-189-9/+9
| | | | | Closes gh-4696 Ref jquery/eslint-config-jquery#15 Ref jquery/eslint-config-jquery#16
* Docs: Change JS Foundation mentions to OpenJS FoundationMichał Gołębiowski-Owczarek2020-05-181-1/+1
| | | Closes gh-4711
* Build: Followups after introducing ES modules compiled via RollupMichał Gołębiowski-Owczarek2020-05-052-2/+2
| | | | | | | | | | This commit cleans up a few comments & configurations that are out of date after the migration to ES modules backed by a Rollup-based compilation. Also, de-indent AMD modules. This will preserve a more similar structure to the one on 3.x-stable where the body of the main `define` wrapper is not indented. Closes gh-4705
* CSS: Include `show`, `hide` & `toggle` methods in the jQuery slim buildMichał Gołębiowski-Owczarek2020-05-051-0/+1
| | | | | | | | | | | | The `show()`, `hide()` & `toggle()` methods were included in the 3.x jQuery slim build. The jQuery master build accidentally started to exclude them as they were only imported in the effects module and the new Rollup-based build system follows the module dependency graph when excluding modules. To resolve the issue, import the `css/showHide.js` file directly in the main `jquery.js` file. Closes gh-4704 Ref jquery/jquery-migrate#346
* Build: Correct code indentations based on jQuery Style GuideWonseop Kim2020-05-0516-42/+60
| | | | | | | | 1. Correct code indentations based on jQuery Style Guide (contribute.jquery.org/style-guide/js/#spacing). 2. Add rules to "src/.eslintrc.json" to enable "enforcing consistent indentation", with minimal changes to the current code. Closes gh-4672
* Build: Move ESLint max-len disable-directive to dist/.eslintrc.jsonEd S2020-04-271-2/+0
| | | | | | | This disable-directive only applies to the built version, so put it in /dist. This avoids a warning about an unused directive in the source version. Closes gh-4676
* Ajax: Overwrite s.contentType with content-type header value, if anyChristian Wenz2020-04-061-0/+9
| | | | | | | | | | | This fixes the issue of "%20" in POST data being replaced with "+" even for requests with content-type different from "application/x-www-form-urlencoded", e.g. for "application/json". Fixes gh-4119 Closes gh-4650 Co-authored-by: Richard Gibson <richard.gibson@gmail.com> Co-authored-by: Michał Gołębiowski-Owczarek <m.goleb@gmail.com>
* Manipulation: Make jQuery.htmlPrefilter an identity functionMichał Gołębiowski-Owczarek2020-03-161-4/+1
| | | Closes gh-4642
* Data:Event:Manipulation: Prevent collisions with Object.prototypeMichał Gołębiowski-Owczarek2020-03-024-9/+11
| | | | | | | Make sure events & data keys matching Object.prototype properties work. A separate fix for such events on cloned elements was added as well. Fixes gh-3256 Closes gh-4603
* Build: Enable ESLint one-var rule for var declarations in browser codeMichał Gołębiowski-Owczarek2020-03-022-5/+6
| | | | | | | Node.js code is written more & more commonly in ES6+ so it doesn't make sense to enable it there. There are many violations in test code so it's disabled there as well. Closes gh-4615
* Core: Fire iframe script in its context, add doc param in globalEvalMichał Gołębiowski-Owczarek2020-02-103-6/+7
| | | | | | | | | | 1. Support passing custom document to jQuery.globalEval; the script will be invoked in the context of this document. 2. Fire external scripts appended to iframe contents in that iframe context; this was already supported & tested for inline scripts but not for external ones. Fixes gh-4518 Closes gh-4601
* Event: remove jQuery.event.globalMichał Gołębiowski-Owczarek2020-02-101-5/+0
| | | | | | | jQuery.event.global has been write-only in the jQuery source for the past few years; reading from it was removed in c2d6847de09a52496f78baebc04f317e11ece6d2 when fixing the trac-12989 bug. Closes gh-4602
* Ajax: Deprecate AJAX event aliases, inline event/alias into deprecatedMichał Gołębiowski-Owczarek2020-01-215-47/+45
| | | | | | | | A new `src/deprecated` directory makes it possible to exclude some deprecated APIs from a custom build when their respective "parent" module is excluded without keeping that module outside of the `src/deprecated` directory or the `src/deprecated.js` file. Closes gh-4572
* CSS: Remove the opacity CSS hookMichał Gołębiowski-Owczarek2020-01-211-12/+1
| | | | | | | | The consequence is `.css( "opacity" )` will now return an empty string for detached elements in standard-compliant browsers and "1" in IE & the legacy Edge. That behavior is shared by most other CSS properties which we're not normalizing either. Closes gh-4593
* Attributes: Refactor val(): don't strip carriage return, isolate IE workaroundsMichał Gołębiowski-Owczarek2020-01-131-22/+19
| | | | | | | | | | Before this change, `val()` was stripping out carriage return characters from the returned value. No test has relied on that. The logic was different for option elements as its custom defined hook was omitting this stripping logic. This commit gets rid of the carriage return removal and isolates the IE-only select val getter to be skipped in other browsers. Closes gh-4585
* Attributes: Don't set the type attr hook at all outside of IEMichał Gołębiowski-Owczarek2020-01-131-17/+18
| | | | | This removes a needless function call in modern browsers. Closes gh-4587
* Build:Tests: Fix custom build tests, verify on Travis Michał Gołębiowski-Owczarek2020-01-073-2/+3
| | | | | | | | | | | This commit fixes unit tests for the following builds: 1. The no-deprecated build: `custom:-deprecated` 2. The current slim build: `custom:-ajax,-effects` 3. The future (#4553) slim build: `custom:-ajax,-callbacks,-deferred,-effects` It also adds separate Travis jobs for the no-deprecated & slim builds. Closes gh-4577
* Selector: Remove the "a:enabled" workaround for Chrome <=77Michał Gołębiowski-Owczarek2019-12-161-9/+0
| | | | | | | Remove the workaround for a broken `:enabled` pseudo-class on anchor elements in Chrome <=77. These versions of Chrome considers anchor elements with the `href` attribute as matching `:enabled`. Closes gh-4569
* Event: Only attach events to objects that accept data - for realMichał Gołębiowski-Owczarek2019-12-091-2/+3
| | | | | | | | | | There was a check in jQuery.event.add that was supposed to make it a noop for objects that don't accept data like text or comment nodes. The problem was the check was incorrect: it assumed `dataPriv.get( elem )` returns a falsy value for an `elem` that doesn't accept data but that's not the case - we get an empty object then. The check was changed to use `acceptData` directly. Fixes gh-4397 Closes gh-4558
* Build: Require extensions for ES6 imports, prevent import cyclesMichał Gołębiowski-Owczarek2019-11-251-0/+7
| | | | | | | | | | | | | | | | jQuery source is now authored in ECMAScript modules. Native browser support for them requires full file names including extensions. Rollup works even if import paths don't specify extensions, though, so one import slipped through without such an extension, breaking native browser import of src/jquery.js. A new ESLint rule using eslint-plugin-import prevents us from regressing on that front. Also, eslint-plugin-import's no-cycle rule is used to avoid import cycles. Closes gh-4544 Ref gh-4541 Ref 075320149ae30a5c593c06b2fb015bdf033e0acf
* Build: Fix the import path to serialize.js from ajax.jsMichał Gołębiowski-Owczarek2019-11-191-1/+1
|
* Selector: Make empty attribute selectors work in IE againMichał Gołębiowski-Owczarek2019-11-183-4/+18
| | | | | | | | | | qSA in IE 11/Edge often (but not always) don't find elements with an empty name attribute selector (`[name=""]`). Detect that & fall back to Sizzle traversal. Interestingly, IE 10 & older don't seem to have the issue. Fixes gh-4435 Closes gh-4510
* Core: Migrate from AMD to ES modules 🎉Michał Gołębiowski-Owczarek2019-11-18112-1088/+563
| | | | | | | | | | | | | | | | | | | | | | Migrate all source AMD modules to ECMAScript modules. The final bundle is compiled by a custom build process that uses Rollup under the hood. Test files themselves are still loaded via RequireJS as that has to work in IE 11. Tests can now be run in "Load as modules" mode which replaces the previous "Load with AMD" option. That option of running tests doesn't work in IE and Edge as it requires support for dynamic imports. Some of the changes required by the migration: * check `typeof` of `noGlobal` instead of using the variable directly as it's not available when modules are used * change the nonce module to be an object as ECMASscript module exports are immutable * remove some unused exports * import `./core/parseHTML.js` directly in `jquery.js` so that it's not being cut out when the `ajax` module is excluded in a custom compilation Closes gh-4541
* Selector: Use shallow document comparisons in uniqueSortMichał Gołębiowski-Owczarek2019-10-211-3/+16
| | | | | | | | | | | | | | IE/Edge sometimes crash when comparing documents between frames using the strict equality operator (`===` & `!==`). Funnily enough, shallow comparisons (`==` & `!=`) work without crashing. The change to shallow comparisons in `src/selector.js` was done in gh-4471 but relevant changes in `src/selector/uniqueSort.js` were missed. Those changes have landed in Sizzle in jquery/sizzle#459. Fixes gh-4441 Closes gh-4512 Ref gh-4471 Ref jquery/sizzle#459
* Docs: Update most URLs to HTTPSMichał Gołębiowski-Owczarek2019-10-211-7/+7
| | | Closes gh-4511
* CSS: Workaround buggy getComputedStyle on table rows in IE/EdgeMichał Gołębiowski-Owczarek2019-10-142-9/+58
| | | | Fixes gh-4490 Closes gh-4506
* Selector: Make selectors with leading combinators use qSA againMichał Gołębiowski-Owczarek2019-10-141-1/+4
| | | | | | | | | | | | | | An optimization added in jquery/sizzle#431 skips the temporary IDs for selectors not using child or descendant combinators. For sibling combinators, though, this pushes a selector with a leading combinator to qSA directly which crashes and falls back to a slower Sizzle route. This commit makes selectors with leading combinators not skip the selector rewriting. Note that after jquery/jquery#4454 & jquery/sizzle#453, all modern browsers other than Edge leverage the :scope pseudo-class, avoiding temporary id attributes. Closes gh-4509 Ref jquery/sizzle#431
* Manipulation:Selector: Use the nodeName util where possible to save sizeMichał Gołębiowski-Owczarek2019-10-082-19/+18
| | | | | Saves 20 bytes. Closes gh-4504
* Ajax: Do not execute scripts for unsuccessful HTTP responsesSean Robinson2019-09-261-0/+5
| | | | | | | | | The script transport used to evaluate fetched script sources which is undesirable for unsuccessful HTTP responses. This is different to other data types where such a convention was fine (e.g. in case of JSON). Fixes gh-4250 Closes gh-4379
* Core: Use Array.prototype.flat where supportedAhmed.S.ElAfifi2019-09-254-13/+21
| | | | | | | | | | | Calling `Array.prototype.concat.apply( [], inputArray )` to flatten `inputArray` crashes for large arrays; using `Array.prototype.flat` avoids these issues in browsers that support it. In case it's necessary to support these large arrays even in older browsers, a polyfill for `Array.prototype.flat` can be loaded. This is already being done by many applications. Fixes gh-4320 Closes gh-4459
* Selector: Use shallow document comparisons to avoid IE/Edge crashesMichał Gołębiowski-Owczarek2019-09-251-13/+24
| | | | | | | | | IE/Edge sometimes crash when comparing documents between frames using the strict equality operator (`===` & `!==`). Funnily enough, shallow comparisons (`==` & `!=`) work without crashing. Fixes gh-4441 Closes gh-4471
* Core: Remove private copies of push, sort & splice from the jQuery prototypeMichał Gołębiowski-Owczarek2019-09-244-13/+15
| | | Closes gh-4473
* Core: Implement .even() & .odd() to replace POS :even & :oddMichał Gołębiowski-Owczarek2019-09-241-0/+12
| | | | | | `:even` & `:odd` are deprecated since jQuery 3.4.0 & will be removed in 4.0.0. The new `even()` & `odd()` methods will make the migration easier. Closes gh-4485
* Deprecated: Fix AMD parameter orderMichał Gołębiowski-Owczarek2019-08-311-1/+1
| | | | Ref gh-4461
* Selector: reduce size, simplify setDocumentMichał Gołębiowski-Owczarek2019-08-262-128/+112
| | | | | | | | | | | With new selector code doing less convoluted support tests, it was possible to extract a lot of logic out of setDocument & also reduce size. This commit also backports jquery/sizzle#439 that was reverted by mistake during a switch from JSHint + JSCS to ESLint. Closes gh-4462 Ref jquery/sizzle#442 Ref jquery/sizzle#439
* Ajax: Simplify jQuery.ajaxSettings.xhrMichał Gołębiowski-Owczarek2019-08-261-3/+1
| | | | | | | | | | | | | | | Previously, jQuery.ajaxSettings.xhr, contents were wrapped in a try-catch as we defined jQuery.support.ajax & jQuery.support.cors executed during the jQuery load and we didn't want to crash if IE had native XHR disabled (which is possible). While jQuery hasn't supported the ActiveX-based XHR since 2.0, jQuery with XHR disabled could still be used for its other features in such a crippled browser. Since gh-4347, jQuery.support.ajax & jQuery.support.cors no longer exist, so we don't need the try-catch anymore. Fixes gh-1967 Closes gh-4467 Ref gh-4347
* Core: Deprecate jQuery.trimShashanka Nataraj2019-08-222-7/+7
| | | | | Fixes gh-4363 Closes gh-4461
* Selector: Leverage the :scope pseudo-class where possibleMichał Gołębiowski-Owczarek2019-08-192-11/+35
| | | | | | | | | | | | | | | | | | | The `:scope` pseudo-class[1] has surprisingly good browser support: Chrome, Firefox & Safari have supported if for a long time; only IE & Edge lack support. This commit leverages this pseudo-class to get rid of the ID hack in most cases. Adding a temporary ID may cause layout thrashing which was reported a few times in [the past. We can't completely eliminate the ID hack in modern browses as sibling selectors require us to change context to the parent and then `:scope` stops applying to what we'd like. But it'd still improve performance in the vast majority of cases. [1] https://developer.mozilla.org/en-US/docs/Web/CSS/:scope Fixes gh-4453 Closes gh-4454 Ref gh-4332 Ref jquery/sizzle#405
* Selector: Bring back querySelectorAll shortcut usageMichał Gołębiowski-Owczarek2019-08-091-2/+1
| | | | | | | Due to a faulty IE 8 workaround removal, the fast path qSA mode was skipped when jQuery's find was called on an element node - i.e. in most cases. 😱 Ref gh-4395 Closes gh-4452
* Selector: Inline Sizzle into the selector moduleMichał Gołębiowski-Owczarek2019-07-2916-310/+1898
| | | | | | | | | | | | | | | | | | This commit removes Sizzle from jQuery, inlining its code & removing obsolete workarounds where applicable. The selector-native module has been removed. Further work on the selector module may decrease the size enough that it will no longer be necessary. If it turns out it's still useful, we'll reinstate it but the code will look different anyway as we'll want to share as much code as possible with the existing selector module. The Sizzle AUTHORS.txt file has been merged with the jQuery one - people are sorted by their first contributions to either of the two repositories. The commit reduces the gzipped jQuery size by 1460 bytes compared to master. Closes gh-4395
* Selector: Port Sizzle tests to jQueryMichał Gołębiowski-Owczarek2019-06-261-5/+9
| | | | | | | Apart from porting most Sizzle tests to jQuery (mostly to its selector module), this commit fixes selector-native so that a jQuery custom compilation that excludes Sizzle passes all tests as well. Closes gh-4406
* Build: ESLint: forbid unused function parametersMichał Gołębiowski-Owczarek2019-05-1316-34/+23
| | | | | | | | | | | | | This commit requires all function parameters to be used, not just the last one. In cases where that's not possible as we need to match an external API, there's an escape hatch of prefixing an unused argument with `_`. This change makes it easier to catch unused AMD dependencies and unused parameters in internal functions the API of which we may change at will, among other things. Unused AMD dependencies have been removed as part of this commit. Closes gh-4381
* Core: Remove IE-specific support tests, rely on document.documentModeMichał Gołębiowski-Owczarek2019-05-139-144/+41
| | | | | | | Also, update some tests to IE-sniff when deciding whether to skip a test. Fixes gh-4386 Closes gh-4387
generated by cgit v1.2.3 (git 2.39.1) at 2025-08-12 13:49:19 +0000