aboutsummaryrefslogtreecommitdiffstats
path: root/test/data
Commit message (Collapse)AuthorAgeFilesLines
* Docs: remove expired links from old jquery source (#4997)Timmy Willison2022-01-071-2/+0
| | | | Ref gh-4981 Ref gh-4991
* Docs: Replace `#NUMBER` Trac issue references with `trac-NUMBER`Michał Gołębiowski-Owczarek2022-01-0410-16/+16
| | | | | | | | | | | | | The GitHub UI treats `#NUMBER` as referring to its own issues which is confusing when in jQuery source it's usually referring to the old deprecated Trac instance at https://bugs.jquery.com. This change replaces all such Trac references with `trac-NUMBER`. A few of the references came with the Sizzle integration and referred to the Sizzle GitHub bug tracker. Those have been replaced with full links instead. A new entry describing issue reference conventions has been added to README. Closes gh-4993
* Attributes: Don't stringify attributes in the setterMichał Gołębiowski-Owczarek2021-11-013-0/+68
| | | | | | | | | | | | | Stringifying attributes in the setter was needed for IE <=9 but it breaks trusted types enforcement when setting a script `src` attribute. Note that this doesn't mean script execution works. Since jQuery disables all scripts by changing their type and then executes them by creating fresh script tags with proper `src` & possibly other attributes, this unwraps any trusted `src` wrappers, making the script not execute under strict CSP settings. We might try to fix it in the future in a separate change. Fixes gh-4948 Closes gh-4949
* Core:Manipulation: Add basic TrustedHTML supportMichał Gołębiowski-Owczarek2021-09-303-3/+84
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This ensures HTML wrapped in TrustedHTML can be used as an input to jQuery manipulation methods in a way that doesn't violate the `require-trusted-types-for` Content Security Policy directive. This commit builds on previous work needed for trusted types support, including gh-4642 and gh-4724. One restriction is that while any TrustedHTML wrapper should work as input for jQuery methods like `.html()` or `.append()`, for passing directly to the `jQuery` factory the string must start with `<` and end with `>`; no trailing or leading whitespaces are allowed. This is necessary as we cannot parse out a part of the input for further construction; that would violate the CSP rule - and that's what's done to HTML input not matching these constraints. No trusted types API is used explicitly in source; the majority of the work is ensuring we don't pass the input converted to string to APIs that would eventually assign it to `innerHTML`. This extra cautiousness is caused by the API being Blink-only, at least for now. The ban on passing strings to `innerHTML` means support tests relying on such assignments are impossible. We don't currently have such tests on the `main` branch but we used to have many of them in the 3.x & older lines. If there's a need to re-add such a test, we'll need an escape hatch to skip them for apps needing CSP-enforced TrustedHTML. See https://web.dev/trusted-types/ for more information about TrustedHTML. Fixes gh-4409 Closes gh-4927 Ref gh-4642 Ref gh-4724
* Tests: Don't remove csp.log in the cspClean action of mock.phpMichał Gołębiowski-Owczarek2021-09-301-1/+0
| | | | | | For some reason the current setup worked fine with Apache but broke for me when I migrated to nginx. Closes gh-4936
* Tests: Load the TestSwarm listener via HTTPSMichał Gołębiowski-Owczarek2021-09-291-1/+1
|
* Manipulation: Don't remove HTML comments from scriptsMichał Gołębiowski-Owczarek2021-07-191-2/+2
| | | | | | | | | | | | | | | | | | | When evaluating scripts, jQuery strips out the possible wrapping HTML comment and a CDATA section. However, all supported browsers are already doing that when loading JS via appending a script tag to the DOM which is how we've been doing `jQuery.globalEval` since jQuery 3.0.0. jQuery logic was imperfect, e.g. it just stripped the `<!--` and `-->` markers, respectively at the beginning or the end of the script contents. However, browsers are also stripping everything following those markers in the same line, treating them as single-line comments delimiters; this is now also mandated by ECMAScript 2015 in Annex B. Instead of fixing the jQuery logic, just let the browser do its thing. We also used to strip CDATA sections. However, this shouldn't be needed as in XML documents they're already not visible when inspecting element contents and in HTML documents they have no meaning. We've preserved that behavior for backwards compatibility in 3.x but we're removing it for 4.0. Fixes gh-4904 Closes gh-4906
* Tests: Switch background image from online file to local 1x1.jpgTimo Tijhof2021-05-241-1/+1
| | | | | Also, remove unused `expected` property in `css` test cases. Closes gh-4866
* Tests: Strip untypical callback parameter characters from mock.phpMichał Gołębiowski-Owczarek2021-04-131-8/+14
| | | | | | | | | | | Only allow alphanumeric characters & underscores for callback parameters. The change is done both for the PHP server as well as the Node.js-based version. This is only test code so we're not fixing any security issue but it happens often enough that the whole jQuery repository directory structure is deployed onto the server with PHP enabled that it makes is easy to introduce security issues if this cleanup is not done. Ref gh-4764 Closes gh-4871
* Build: Take core-js-bundle from the external directory as wellMichał Gołębiowski-Owczarek2021-04-131-1/+1
| | | | | | | That package was missed in gh-4865 as it only broke browsers needing the polyfill which is just IE at the moment. Thus, it broke Core tests in IE only. Ref gh-4865 Closes gh-4870
* Manipulation: Respect script crossorigin attribute in DOM manipulation高灰2020-09-221-1/+15
| | | | | | Fixes gh-4542 Closes gh-4563 Co-authored-by: Michał Gołębiowski-Owczarek <m.goleb@gmail.com>
* Ajax: Avoid CSP errors in the script transport for async requestsMichał Gołębiowski-Owczarek2020-08-254-4/+45
| | | | | | | | | | | | | | | | | Until now, the AJAX script transport only used a script tag to load scripts for cross-domain requests or ones with `scriptAttrs` set. This commit makes it also used for all async requests to avoid CSP errors arising from usage of inline scripts. This also makes `jQuery.getScript` not trigger CSP errors as it uses the AJAX script transport under the hood. For sync requests such a change is impossible and that's what `jQuery._evalUrl` uses. Fixing that is tracked in gh-1895. The commit also makes other type of requests using the script tag version of the script transport set its type to "GET", namely async scripts & ones with `scriptAttrs` set in addition to the existing cross-domain ones. Fixes gh-3969 Closes gh-4763
* Ajax: Drop the json to jsonp auto-promotion logicMichał Gołębiowski-Owczarek2020-07-271-0/+4
| | | | | | | | | | | | | | | | | | | | Previously, `jQuery.ajax` with `dataType: 'json'` with a provided callback was automatically converted to a jsonp request unless one also specified `jsonp: false`. Today the preferred way of interacting with a cross-domain backend is CORS which works in all browsers jQuery 4 will support. Auto-promoting JSON requests to JSONP ones introduces a security issue as the developer may be unaware they're not just downloading data but executing code from a remote domain. This commit disables the auto-promoting logic. BREAKING CHANGE: to trigger a JSONP request, it's now required to specify `dataType: "jsonp"`; previously some requests with `dataType: "json"` were auto-promoted to JSONP. Fixes gh-1799 Fixes gh-3376 Closes gh-4754
* Tests: Remove remaining obsolete jQuery.cache referencesMichał Gołębiowski-Owczarek2020-05-181-22/+2
| | | | | | PR gh-4586 removed some of those but not all. Closes gh-4715 Ref gh-4586
* Manipulation: Make jQuery.htmlPrefilter an identity functionMichał Gołębiowski-Owczarek2020-03-161-1/+1
| | | Closes gh-4642
* Core: Fire iframe script in its context, add doc param in globalEvalMichał Gołębiowski-Owczarek2020-02-103-4/+33
| | | | | | | | | | 1. Support passing custom document to jQuery.globalEval; the script will be invoked in the context of this document. 2. Fire external scripts appended to iframe contents in that iframe context; this was already supported & tested for inline scripts but not for external ones. Fixes gh-4518 Closes gh-4601
* Event: remove jQuery.event.globalMichał Gołębiowski-Owczarek2020-02-101-1/+0
| | | | | | | jQuery.event.global has been write-only in the jQuery source for the past few years; reading from it was removed in c2d6847de09a52496f78baebc04f317e11ece6d2 when fixing the trac-12989 bug. Closes gh-4602
* Tests: Remove obsolete jQuery data testsMichał Gołębiowski-Owczarek2020-01-131-92/+0
| | | | | The tests relied on `jQuery.cache` so they only ever worked in jQuery 1.x. Closes gh-4586
* Build:Tests: Fix custom build tests, verify on Travis Michał Gołębiowski-Owczarek2020-01-079-46/+44
| | | | | | | | | | | This commit fixes unit tests for the following builds: 1. The no-deprecated build: `custom:-deprecated` 2. The current slim build: `custom:-ajax,-effects` 3. The future (#4553) slim build: `custom:-ajax,-callbacks,-deferred,-effects` It also adds separate Travis jobs for the no-deprecated & slim builds. Closes gh-4577
* Build: Make Karma work in ES modules modeMichał Gołębiowski-Owczarek2019-12-162-3/+22
| | | | | | Also, run such a suite in CI to make sure modules are working as expected when used directly. Closes gh-4550
* Build: Auto-convert sources to AMDMichał Gołębiowski-Owczarek2019-12-091-5/+7
| | | | | | | | | | | | | | | jQuery source has been migrated in gh-4541 from AMD to ES modules. To maintain support for consumers of our AMD modules, this commits adds a task transpiling the ES modules sources in `src/` to AMD in `amd/`. A "Load with AMD" checkbox was also restored to the QUnit setup. Note that, contrary to jQuery 3.x, AMD files need to be generated via `grunt amd` or `grunt` as sources are not authored in ECMAScript modules. To achieve a similar no-compile experience during jQuery 4.x testing, use the new "Load as modules" checkbox which works in all supported browsers except for IE & Edge (the legacy, EdgeHTML-based one). Ref gh-4541 Closes gh-4554
* Selector: Make empty attribute selectors work in IE againMichał Gołębiowski-Owczarek2019-11-182-1/+6
| | | | | | | | | | qSA in IE 11/Edge often (but not always) don't find elements with an empty name attribute selector (`[name=""]`). Detect that & fall back to Sizzle traversal. Interestingly, IE 10 & older don't seem to have the issue. Fixes gh-4435 Closes gh-4510
* Core: Migrate from AMD to ES modules 🎉Michał Gołębiowski-Owczarek2019-11-181-1/+1
| | | | | | | | | | | | | | | | | | | | | | Migrate all source AMD modules to ECMAScript modules. The final bundle is compiled by a custom build process that uses Rollup under the hood. Test files themselves are still loaded via RequireJS as that has to work in IE 11. Tests can now be run in "Load as modules" mode which replaces the previous "Load with AMD" option. That option of running tests doesn't work in IE and Edge as it requires support for dynamic imports. Some of the changes required by the migration: * check `typeof` of `noGlobal` instead of using the variable directly as it's not available when modules are used * change the nonce module to be an object as ECMASscript module exports are immutable * remove some unused exports * import `./core/parseHTML.js` directly in `jquery.js` so that it's not being cut out when the `ajax` module is excluded in a custom compilation Closes gh-4541
* Docs: Update most URLs to HTTPSMichał Gołębiowski-Owczarek2019-10-214-10/+10
| | | Closes gh-4511
* Tests: Stop using jQuery.find in testsMichał Gołębiowski-Owczarek2019-10-211-1/+1
| | | | | This prepares us for possibly hiding jQuery.find in jQuery 4.0. Closes gh-4517
* Ajax: Do not execute scripts for unsuccessful HTTP responsesSean Robinson2019-09-261-0/+13
| | | | | | | | | The script transport used to evaluate fetched script sources which is undesirable for unsuccessful HTTP responses. This is different to other data types where such a convention was fine (e.g. in case of JSON). Fixes gh-4250 Closes gh-4379
* Tests: Fix a comment in testinit.jsMichał Gołębiowski-Owczarek2019-08-191-1/+0
| | | | | | | A copied comment line was accidentally left out above the line defining `QUnit.jQuerySelectorsPos`, making the sentence nonsense. This commit removes that line. Closes gh-4458
* Selector: Inline Sizzle into the selector moduleMichał Gołębiowski-Owczarek2019-07-293-5/+16
| | | | | | | | | | | | | | | | | | This commit removes Sizzle from jQuery, inlining its code & removing obsolete workarounds where applicable. The selector-native module has been removed. Further work on the selector module may decrease the size enough that it will no longer be necessary. If it turns out it's still useful, we'll reinstate it but the code will look different anyway as we'll want to share as much code as possible with the existing selector module. The Sizzle AUTHORS.txt file has been merged with the jQuery one - people are sorted by their first contributions to either of the two repositories. The commit reduces the gzipped jQuery size by 1460 bytes compared to master. Closes gh-4395
* Selector: Port Sizzle tests to jQueryMichał Gołębiowski-Owczarek2019-06-264-15/+129
| | | | | | | Apart from porting most Sizzle tests to jQuery (mostly to its selector module), this commit fixes selector-native so that a jQuery custom compilation that excludes Sizzle passes all tests as well. Closes gh-4406
* Core: Remove IE-specific support tests, rely on document.documentModeMichał Gołębiowski-Owczarek2019-05-134-10/+10
| | | | | | | Also, update some tests to IE-sniff when deciding whether to skip a test. Fixes gh-4386 Closes gh-4387
* Core: Drop support for IE <11, iOS <11, Firefox <65, Android Browser & PhantomJSMichał Gołębiowski-Owczarek2019-04-293-63/+8
| | | | | | | | | | | Also, update support comments format to match format described in: https://github.com/jquery/contribute.jquery.org/issues/95#issuecomment-69379197 with the change from: https://github.com/jquery/contribute.jquery.org/issues/95#issuecomment-448998379 (open-ended ranges end with `+`). Fixes gh-3950 Fixes gh-4299 Closes gh-4347
* Tests: Fix the core-js polyfill inclusion methodMichał Gołębiowski-Owczarek2019-04-041-1/+1
| | | | | | | | core-js 3 no longer includes a built file in the bundle but core-js-bundle does. Closes gh-4342 Ref gh-4341
* Core: Preserve CSP nonce on scripts with src attribute in DOM manipulationbuddh42019-03-252-0/+18
| | | | | Fixes gh-4323 Closes gh-4328
* Build: Run the basic test suite in jsdomMichał Gołębiowski-Owczarek2019-03-111-0/+40
| | | | | | The basic test suite is now run in jsdom on all supported Node.js versions (8, 10 & 11 as of now). Closes gh-4310
* Build: Remove manual QUnit fixture resettingMichał Gołębiowski-Owczarek2019-03-111-2/+0
| | | | | | It was needed when QUnit 1.x one used but we've since upgraded to QUnit 2.x. Closes gh-4312 Ref gh-4307
* Build: Update QUnit from 1.23.1 to 2.9.2Michał Gołębiowski-Owczarek2019-03-042-2/+2
| | | Closes gh-4307
* Build: Update jsdom; migrate a test with Symbol polyfill to an iframe testMichał Gołębiowski-Owczarek2019-03-042-0/+28
| | | | | | | | | | | So far, we've been testing that jQuery element iteration works with polyfilled Symbol & transpiled for-of via a Node test with jsdom with the Symbol global removed. Unfortunately, jsdom now requires Symbol to be present for its internal functionality so such a test is no longer possible. Instead, it's been migrated to an iframe test with transpiled JavaScript. This PR also enables us to use ECMAScript 2017 or newer in Node.js code. Closes gh-4305
* Build: Update test code for compatibility with QUnit 2.x (#4297)abnud12019-02-189-17/+17
| | | | | | | | Also, run `grunt npmcopy` to sync the "external" directory with dependencies from package.json. For example, the Sinon library version didn't match. Ref gh-4234 Closes gh-4297
* Core: Support passing nonce through jQuery.globalEvalMichał Gołębiowski-Owczarek2019-01-213-1/+20
| | | | | | Fixes gh-4278 Closes gh-4280 Ref gh-3541 Ref gh-4269
* Manipulation: Respect script nomodule attribute in DOM manipulationMichał Gołębiowski-Owczarek2019-01-212-0/+2
| | | | | | | | | | | | | PR #3869 added support for `<script type="module">` & some support for the `nomodule` attribute but with no tests for `nomodule` and with the attribute only respected on inline scripts. This commit adds support for source-based scripts as well. It also adds tests for `nomodule`, including making sure legacy browsers execute such scripts as they'd natively do - that's the whole point of `nomodule` scripts, after all. Fixes gh-4281 Closes gh-4282 Ref gh-3871 Ref gh-3869
* Core: Preserve CSP nonce on scripts in DOM manipulationMichał Gołębiowski-Owczarek2019-01-143-0/+29
| | | | Fixes gh-3541 Closes gh-4269
* Dimensions: fall back to offsetWidth/Height for border-box in IETimmy Willison2018-11-271-0/+4
| | | | | | | | - Use getClientRects() to explicitly detect hidden/disconnected elements Close gh-4223 Fixes gh-4102
* Tests: fix ajax test failure; add to header instead of replaceTimmy Willison2018-11-261-1/+1
|
* Ajax: Fix getResponseHeader(key) for IE11Andrei Fangli2018-11-261-0/+3
| | | | | | | | | | | - getResponseHeader(key) combines all header values for the provided key into a single result where values are concatenated by ', '. This does not happen for IE11 since multiple values for the same header are returned on separate lines. This makes the function only return the last value of the header for IE11. - Updated ajax headers test to better cover Object.prototype collisions Close gh-4173 Fixes gh-3403
* Tests: Allow Karma to load unminfied sourceRichard Gibson2018-09-071-14/+28
| | | Closes gh-4128
* Traversing: $.fn.contents() support for objectLuis Emilio Velasco Sanchez2018-05-142-0/+15
| | | | | Fixes gh-4045 Closes gh-4046
* CSS: Correctly detect scrollbox support with non-default zoomRichard Gibson2018-05-071-1/+5
| | | | Fixes gh-4029 Closes gh-4030
* Tests: ensure that module assertions run on supported browsersTimmy Willison2018-01-162-1/+11
| | | | | | - Also fixes tests for karma, where the URL for the module is different Ref gh-3871
* Manipulation: Add support for scripts with module typebasil.belokon2018-01-162-0/+2
| | | | | Fixes gh-3871 Close gh-3869
* Core: deprecate jQuery.isFunctionJason Bedard2018-01-151-2/+2
| | | | Fixes gh-3609
generated by cgit v1.2.3 (git 2.39.1) at 2025-08-11 18:25:37 +0000