jquery.git - jQuery JavaScript Library: https://github.com/jquery/jquery

index : jquery.git

jQuery JavaScript Library: https://github.com/jquery/jquery

www-data

about summary refs log tree commit diff stats

path: root/test/data/trusted-types-attributes.js

	Commit message (Collapse)	Author	Age	Files	Lines
*	Attributes: Don't stringify attributes in the setter	Michał Gołębiowski-Owczarek	2021-11-01	1	-0/+1
	Stringifying attributes in the setter was needed for IE <=9 but it breaks trusted types enforcement when setting a script `src` attribute. Note that this doesn't mean script execution works. Since jQuery disables all scripts by changing their type and then executes them by creating fresh script tags with proper `src` & possibly other attributes, this unwraps any trusted `src` wrappers, making the script not execute under strict CSP settings. We might try to fix it in the future in a separate change. Fixes gh-4948 Closes gh-4949