aboutsummaryrefslogtreecommitdiffstats
path: root/test
Commit message (Collapse)AuthorAgeFilesLines
...
* Tests: Disable the ":lang respects escaped backslashes" testMichał Gołębiowski-Owczarek2023-06-271-3/+13
| | | | | | | | | | | Firefox 114+ no longer match on backslashes in `:lang()`, even when escaped. It is an intentional change as `:lang()` parameters are supposed to be valid BCP 47 strings. Therefore, we won't attempt to patch it. We'll keep this test here until other browsers match the behavior. Fixes gh-5271 Closes gh-5277 Ref https://bugzilla.mozilla.org/show_bug.cgi?id=1839747#c1 Ref https://github.com/w3c/csswg-drafts/issues/8720#issuecomment-1509242961
* Core: Fix regression in jQuery.text() on HTMLDocument objectsTimo Tijhof2023-06-121-2/+5
| | | | | | | Fixes gh-5264 Closes gh-5265 (cherry picked from commit 44c56f87a31fbc1f43ac575cfd06a0df12073352)
* Selector: Re-expose jQuery.find.{tokenize,select,compile,setDocument}Michał Gołębiowski-Owczarek2023-06-121-0/+229
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | `Sizzle.tokenize` is an internal Sizzle API, but exposed. As a result, it has historically been available in jQuery via `jQuery.find.tokenize`. That got dropped during Sizzle removal; this change restores the API. Some other APIs so far only exposed on the `3.x` line are also added back: * `jQuery.find.select` * `jQuery.find.compile` * `jQuery.find.setDocument` In addition to that, Sizzle tests have been backported for the following APIs: * `jQuery.find.matchesSelector` * `jQuery.find.matches` * `jQuery.find.compile` * `jQuery.find.select` A new test was also added for `jQuery.find.tokenize` - even Sizzle was missing one. Fixes gh-5259 Closes gh-5263 Ref gh-5260 Ref jquery/sizzle#242 Ref gh-5113 Ref gh-4395 Ref gh-4406
* Tests: Indicate Chrome 112 & Safari 16.4 pass the cssHas support testMichał Gołębiowski-Owczarek2023-04-051-13/+25
| | | | | | | | | | | Chrome 112 & Safari 16.4 introduce two changes: * `:has()` is non-forgiving * `CSS.supports( "selector(...)" )` parses everything in a non-forgiving way We no longer care about the latter but the former means the `cssHas` support test now passes. Closes gh-5225
* CSS: Make `offsetHeight( true )`, etc. include negative marginsMichał Gołębiowski-Owczarek2023-04-041-1/+6
| | | | | | | | | | | | This regressed in gh-3656 as the added logic to include scroll gutters in `.innerWidth()` / `.innerHeight()` didn't take negative margins into account. This broke handling of negative margins in `.offsetHeight( true )` and `.offsetWidth( true )`. To fix it, calculate margin delta separately and only add it after the scroll gutter adjustment logic. Fixes gh-3982 Closes gh-5234 Ref gh-3656
* Event: Avoid collisions between jQuery.event.special & Object.prototypeMichał Gołębiowski-Owczarek2023-04-031-0/+20
| | | | | | | This is a follow-up to similar changes to data & event storages from gh-4603. Closes gh-5235 Ref gh-4603
* Event: Make trigger(focus/blur/click) work with native handlersMichał Gołębiowski-Owczarek2023-03-271-2/+61
| | | | | | | | | | | | | | | | | | In `leverageNative`, instead of calling `event.stopImmediatePropagation()` which would abort both native & jQuery handlers, set the wrapper's `isImmediatePropagationStopped` property to a function returning `true`. Since for each element + type pair jQuery attaches only one native handler, there is also only one wrapper jQuery event so this achieves the goal: on the target element jQuery handlers don't fire but native ones do. Unfortunately, this workaround doesn't work for handlers on ancestors - since the native event is re-wrapped by a jQuery one on each level of the propagation, the only way to stop it for jQuery was to stop it for everyone via native `stopPropagation()`. This is not a problem for `focus`/`blur` which don't bubble, but it does also stop `click` on checkboxes and radios. We accept this limitation. Fixes gh-5015 Closes gh-5228
* Event: Simulate focus/blur in IE via focusin/focusoutMichał Gołębiowski-Owczarek2023-03-271-120/+202
| | | | | | | | | | | | | | | | | | | | | | | | In IE (all versions), `focus` & `blur` handlers are fired asynchronously but `focusin` & `focusout` are run synchronously. In other browsers, all those handlers are fired synchronously. Asynchronous behavior of these handlers in IE caused issues for IE (gh-4856, gh-4859). We now simulate `focus` via `focusin` & `blur` via `focusout` in IE to avoid these issues. This also let us simplify some tests. This commit also simplifies `leverageNative` - with IE now using `focusin` to simulate `focus` and `focusout` to simulate `blur`, we don't have to deal with async events in `leverageNative`. This also fixes broken `focus` triggers after first triggering it on a hidden element - previously, `leverageNative` assumed that the native `focus` handler not firing after calling the native `focus` method meant it would be handled later, asynchronously, which was not the case (gh-4950). Fixes gh-4856 Fixes gh-4859 Fixes gh-4950 Closes gh-5223 Co-authored-by: Richard Gibson <richard.gibson@gmail.com>
* Ajax: Don't treat array data as binaryMichał Gołębiowski-Owczarek2023-03-211-67/+201
| | | | | | | | | | | | | PR gh-5197 started treating all non-string non-plain-object `data` values as binary. However, `jQuery.ajax` also supports arrays as values of `data`. This change makes regular arrays no longer be considered binary data. Surprisingly, we had no tests for array `data` values; otherwise, we'd detect the issue earlier. This change also adds a few such missing tests. Closes gh-5203 Ref gh-5197
* Ajax: Allow `processData: true` even for binary dataMichał Gołębiowski-Owczarek2023-03-201-0/+23
| | | | | | | | | | The way gh-5197 implemented binary data handling, `processData` was being explicitly set to `false`. This is expected but it made it impossible to override it to `true`. The new logic will only set `processData` to `false` if it wasn't explicitly passed in original options. Closes gh-5205 Ref gh-5197
* Tests: Test AJAX deprecated event aliases properlyMichał Gołębiowski-Owczarek2023-03-151-5/+5
| | | | | | | | PR gh-5046 erroneously changed AJAX deprecated event alias usage in deprecated tests to `.on()` calls. This change reverses this mistake. Closes gh-5195 Ref gh-5046
* Deferred: Rename `getStackHook` to `getErrorHook`Michał Gołębiowski-Owczarek2023-03-141-6/+6
| | | | | | | | | | | | | | Rename `jQuery.Deferred.getStackHook` to `jQuery.Deferred.getErrorHook` to indicate passing an error instance is usually a better choice - it works with source maps while a raw stack generally does not. In jQuery `3.7.0`, we'll keep both names, marking the old one as deprecated. In jQuery `4.0.0` we'll just keep the new one. This change implements the `4.0.0` version; PR gh-5212 implements the `3.7.0` one. Fixes gh-5201 Closes gh-5211 Ref gh-5212
* Selector: Stop relying on CSS.supports( "selector(...)" )Michał Gołębiowski-Owczarek2023-02-141-8/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | `CSS.supports( "selector(...)" )` has different semantics than selectors passed to `querySelectorAll`. Apart from the fact that the former returns `false` for unrecognized selectors and the latter throws, `qSA` is more forgiving and accepts some invalid selectors, auto-correcting them where needed - for example, mismatched brackers are auto-closed. This behavior difference is breaking for many users. To add to that, a recent CSSWG resolution made `:is()` & `:where()` the only pseudos with forgiving parsing; browsers are in the process of making `:has()` parsing unforgiving. Taking all that into account, we go back to our previous try-catch approach without relying on `CSS.supports( "selector(...)" )`. The only difference is we detect forgiving parsing in `:has()` and mark the selector as buggy. The PR also updates `playwright-webkit` so that we test against a version of WebKit that already has non-forgiving `:has()`. Fixes gh-5194 Closes gh-5206 Ref gh-5098 Ref gh-5107 Ref w3c/csswg-drafts#7676 Co-authored-by: Richard Gibson <richard.gibson@gmail.com>
* Selector: Backport jQuery selection context logic to selector-nativeMichał Gołębiowski-Owczarek2023-02-133-79/+51
| | | | | | | | | | | | | | | | | | | | | | This makes: ```js $div.find("div > *") ``` no longer matching children of `$div`. Also, leading combinators now work, e.g.: ```js $div.find( "> *" ); ``` returns children of `$div`. As a result of that, a number of tests are no longer skipped in the `selector-native` mode. Also, rename `rcombinators` to `rleadingCombinator`. Fixes gh-5185 Closes gh-5186 Ref gh-5085
* Ajax: Support binary data (including FormData)Michał Gołębiowski-Owczarek2023-02-014-2/+87
| | | | | | | | | | | | Two changes have been applied: * prefilters are now applied before data is converted to a string; this allows prefilters to disable such a conversion * a prefilter for binary data is added; it disables data conversion for non-string non-plain-object `data`; for `FormData` bodies, it removes manually-set `Content-Type` header - this is required as browsers need to append their own boundary to the header Ref gh-4150 Closes gh-5197
* Deferred: Respect source maps in jQuery.Deferred.exceptionHookMichał Gołębiowski-Owczarek2023-02-011-3/+3
| | | | | | | | | | | | | | | | | | So far, `jQuery.Deferred.exceptionHook` used to log error message and stack separately. However, that breaks browser applying source maps against the stack trace - most browsers require logging an error instance. This change makes us do exactly that. One drawback of the change is that in IE 11 previously stack was printed directly and now just the error summary; to get to the actual stack trace, three clicks are required. This seems to be a low price to pay for having source maps work in all the other browsers, though. Safari with the new change requires one click to get to the stack trace which sounds manageable. Fixes gh-3179 Closes gh-5192 Ref https://crbug.com/622227
* Ajax: Support `headers` for script transport even when cross-domainMichał Gołębiowski-Owczarek2023-02-011-24/+80
| | | | | | | | | | | | | | | | The AJAX script transport has two versions: XHR + `jQuery.globalEval` or appending a script tag (note that `jQuery.globalEval` also appends a script tag now, but inline). The former cannot support the `headers` option which has so far not been taken into account. For jQuery 3.x, the main consequence was the option not being respected for cross-domain requests. Since in 4.x we use the latter way more often, the option was being ignored in more cases. The transport now checks whether the `headers` option is specified and uses the XHR way unless `scriptAttrs` are specified as well. Fixes gh-5142 Closes gh-5193
* Build: Run GitHub Action browser tests on Playwright WebKitMichał Gołębiowski-Owczarek2023-01-234-7/+28
| | | | | | | | | | | | | | | | | | | | | | | | So far, we've been running browser tests on GitHub Actions in Chrome and Firefox. Regular Safari is not available in GitHub Actions but Playwright WebKit comes close to a dev version of Safari. With this change, our GitHub CI & local test runs will invoke tests on all actively developed browser engines on all PRs. Also, our GitHub Actions browser tests are now running on Node.js 18. Detection of the Playwright WebKit browser in support unit tests is done by checking if the `test_browser` query parameter is set to `"Playwright"`; this is a `karma-webkit-launcher` feature. Detecting that browser via user agent as we normally do is hard as the UA on Linux is very similar to a real Safari one but it actually uses a newer version of the engine. In addition, we now allow to pass custom browsers when one needs it; e.g., to run the tests in all three engines on Linux/macOS, run: ``` grunt && BROWSERS=ChromeHeadless,FirefoxHeadless,WebkitHeadless grunt karma:main ``` Closes gh-5190
* Build: Migrate middleware-mockserver to modern JSMichał Gołębiowski-Owczarek2023-01-232-60/+80
| | | | | | | | | The `test/middleware-mockserver.js` file used to have the same ESLint settings applied as other test files that are directly run in tested browsers. Now it shares settings of other Node.js files. The file is now also written using modern JS, leveraging ES2018. Closes gh-5196
* Selector: Make selector lists work with `qSA` againMichał Gołębiowski-Owczarek2022-12-191-1/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | jQuery 3.6.2 started using `CSS.supports( "selector(SELECTOR)" )` before using `querySelectorAll` on the selector. This was to solve gh-5098 - some selectors, like `:has()`, now had their parameters parsed in a forgiving way, meaning that `:has(:fakepseudo)` no longer throws but just returns 0 results, breaking that jQuery mechanism. A recent spec change made `CSS.supports( "selector(SELECTOR)" )` always use non-forgiving parsing, allowing us to use this API for what we've used `try-catch` before. To solve the issue on the spec side for older jQuery versions, `:has()` parameters are no longer using forgiving parsing in the latest spec update but our new mechanism is more future-proof anyway. However, the jQuery implementation has a bug - in `CSS.supports( "selector(SELECTOR)" )`, `SELECTOR` needs to be a `<complex-selector>` and not a `<complex-selector-list>`. Which means that selector lists now skip `qSA` and go to the jQuery custom traversal: ```js CSS.supports("selector(div:valid, span)"); // false CSS.supports("selector(div:valid)"); // true CSS.supports("selector(span)"); // true ``` To solve this, this commit wraps the selector list passed to `CSS.supports( "selector(:is(SELECTOR))" )` with `:is`, making it a single selector again. See: * https://w3c.github.io/csswg-drafts/css-conditional-4/#at-supports-ext * https://w3c.github.io/csswg-drafts/selectors-4/#typedef-complex-selector * https://w3c.github.io/csswg-drafts/selectors-4/#typedef-complex-selector-list Fixes gh-5177 Closes gh-5178 Ref w3c/csswg-drafts#7280
* Core:Selector: Move jQuery.contains from the selector to the core moduleMichał Gołębiowski-Owczarek2022-12-122-55/+56
| | | | | | | The `jQuery.contains` method is quite simple in jQuery 4+. On the other side, it's a dependency of the core `isAttached` util which is not ideal; moving it from the `selector` the `core` module resolves the issue. Closes gh-5167
* Selector: Implement the `uniqueSort` chainable methodMichał Gołębiowski-Owczarek2022-11-281-22/+56
| | | | | | | | | Some APIs, like `.prevAll()`, return elements in the reversed order, causing confusing behavior when used with wrapping methods (see gh-5149 for more info) To provide an easy workaround, this commit implements a chainable `uniqueSort` method on jQuery objects, an equivalent of `jQuery.uniqueSort`. Fixes gh-5166 Closes gh-5168
* Tests: Indicate Firefox 106+ passes the `cssSupportsSelector` testMichał Gołębiowski-Owczarek2022-11-251-1/+7
| | | | | | Firefox 106 adjusted to the spec mandating that `CSS.supports("selector(...)")` uses non-forgiving parsing which makes it pass the relevant support test. Closes gh-5141
* Selector: Re-introduce selector-native.jsMichał Gołębiowski-Owczarek2022-11-213-14/+37
| | | | | | | | | | | | | | | | | | | | | Re-introduce the `selector-native` similar to the one on the `3.x-stable` branch. One difference is since the `main` branch inlined Sizzle, some selector utils can be shared between the main `selector` module and `selector-native`. The main `selector` module can be disabled in favor of `selector-native` via: grunt custom:-selector Other changes: * Tests: Fix Safari detection - Chrome Headless has a different user agent than Safari and a browser check in selector tests didn't take that into account. * Tests: Run selector-native tests in `npm test` * Selector: Fix querying on document fragments Ref gh-4395 Closes gh-5085
* Selector:Manipulation: Fix DOM manip within template contentsMichał Gołębiowski-Owczarek2022-11-142-0/+53
| | | | | | | | | | | | | | | | The `<template/>` element `contents` property is a document fragment that may have a `null` `documentElement`. In Safari 16 this happens in more cases due to recent spec changes - in particular, even if that document fragment is explicitly adopted into an outer document. We're testing both of those cases now. The crash used to happen in `jQuery.contains`. As it turns out, we don't need to query the supposed container `documentElement` if it has the `Node.DOCUMENT_NODE` (9) `nodeType`; we can call `.contains()` directly on the `document`. That avoids the crash. Fixes gh-5147 Closes gh-5158
* Ajax: Support `null` as success functions in `jQuery.get`Michał Gołębiowski-Owczarek2022-10-172-4/+24
| | | | | | | | | | | | | According to the docs, one can use `null` as a success function in `jQuery.get` of `jQuery.post` so the following: ```js await jQuery.get( "https://httpbin.org/json", null, "text" ) ``` should get the text result. However, this shortcut hasn't been working so far. Fixes gh-4989 Closes gh-5139
* Selector: Drop support for legacy pseudos, test custom pseudosMichał Gołębiowski-Owczarek2022-10-111-0/+74
| | | | | | | | | This backports custom pseudos tests from Sizzle; they were missed in original test backports. Also, the support for legacy custom pseudos has been dropped. The `jQuery.expr` test cleanup has been wrapped in `try-finally` for cleaner test isolation in case anything goes wrong. Closes gh-5137
* Manipulation: Extract domManip to a separate fileMichał Gołębiowski-Owczarek2022-10-101-3/+3
| | | | | | | | | | | We've already had `buildFragment` extracted to a separate file long ago. `domManip` is quite a complex & crucial API and so far it has existed within the `manipulation.js` module. Extracting it makes the module shorter and easier to understand. A few comments / messages in tests have also been updated to not suggest there's a public `jQuery.domManip` API - it's been private since 3.0.0. Closes gh-5138
* Tests: Remove a workaround for a Firefox XML parsing issueMichał Gołębiowski-Owczarek2022-10-031-7/+1
| | | | | | | | | Firefox 96-100 used to report the column number smaller by 2 than it should in the `parsererror` element generated for invalid XML documents. Since that version range is unsupported now and it includes no ESR versions, the workaround can now be dropped. Closes gh-5109 Ref gh-5018
* CSS: Return `undefined` for whitespace-only CSS variable values (#5120)Michał Gołębiowski-Owczarek2022-10-031-1/+3
| | | | | | | | | | | | | | | | The spec requires that CSS variable values are trimmed. In browsers that do this - mainly, Safari, but also Firefox if the value only has leading whitespace - we currently return undefined; in other browsers, we return an empty string as the logic to fall back to undefined happens before trimming. This commit adds another explicit callback to `undefined` to have it consistent across browsers. Also, more explicit comments about behaviors we need to work around in various browsers have been added. Closes gh-5120 Ref gh-5106
* CSS: Don’t trim whitespace of undefined custom propertyAnders Kaseorg2022-09-191-1/+4
| | | | | | Fixes gh-5105 Closes gh-5106 Signed-off-by: Anders Kaseorg <andersk@mit.edu>
* Selector: Use jQuery `:has` if `CSS.supports(selector(...))` non-compliantMichał Gołębiowski-Owczarek2022-09-192-6/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | jQuery has followed the following logic for selector handling for ages: 1. Modify the selector to adhere to scoping rules jQuery mandates. 2. Try `qSA` on the modified selector. If it succeeds, use the results. 3. If `qSA` threw an error, run the jQuery custom traversal instead. It worked fine so far but now CSS has a concept of forgiving selector lists that some selectors like `:is()` & `:has()` use. That means providing unrecognized selectors as parameters to `:is()` & `:has()` no longer throws an error, it will just return no results. That made browsers with native `:has()` support break selectors using jQuery extensions inside, e.g. `:has(:contains("Item"))`. Detecting support for selectors can also be done via: ```js CSS.supports( "selector(SELECTOR_TO_BE_TESTED)" ) ``` which returns a boolean. There was a recent spec change requiring this API to always use non-forgiving parsing: https://github.com/w3c/csswg-drafts/issues/7280#issuecomment-1143852187 However, no browsers have implemented this change so far. To solve this, two changes are being made: 1. In browsers supports the new spec change to `CSS.supports( "selector()" )`, use it before trying `qSA`. 2. Otherwise, add `:has` to the buggy selectors list. Fixes gh-5098 Closes gh-5107 Ref w3c/csswg-drafts#7676
* Tests: Fix the link to QUnit CSS fileMichał Gołębiowski-Owczarek2022-08-291-1/+1
| | | | | | | | Without this fix, the layout is fine during the test run but all the CSS is gone when tests finish and the results are shown. This affects commands like `grunt karma:chrome-debug`. Closes gh-5090
* Tests: Exclude tests based on compilation flags, not API presenceMichał Gołębiowski-Owczarek2022-06-2822-57/+145
| | | | | | | | | | Introduces a new test API, `includesModule`. The method returns whether a particular module like "ajax" or "deprecated" is included in the current jQuery build; it handles the slim build as well. The util was created so that we don't treat presence of particular APIs to decide whether to run a test as then if we accidentally remove an API, the tests would still not fail. Fixes gh-5069 Closes gh-5046
* Effects: Remove jQuery.fx.intervalMichał Gołębiowski-Owczarek2022-03-013-179/+154
| | | | | | | `jQuery.fx.interval` has been deprecated since jQuery 3.0.0 but it has been still used in jQuery code until this change. This commit removes the definition and explicitly uses the `13` number in its place. Closes gh-5017
* Tests: Workaround an XML parsing bug in FirefoxMichał Gołębiowski-Owczarek2022-02-281-1/+7
| | | | | See https://bugzilla.mozilla.org/show_bug.cgi?id=1751796 Closes gh-5018
* CSS: Skip falsy values in `addClass( array )`, compress codeMichał Gołębiowski-Owczarek2022-01-241-0/+38
| | | | | | | | | | | | | | | This change makes jQuery skip falsy values in `addClass( array )` & `removeClass( array )` instead of stopping iteration when the first falsy value is detected. This makes code like: ```js elem.addClass( [ "a", "", "b" ] ); ``` add both the `a` & `b` classes. The code was also optimized for size a bit so it doesn't increase the minified gzipped size. Fixes gh-4998 Closes gh-5003
* Core: Don't rely on splice being present on inputBruno PIERRE2022-01-241-5/+7
| | | | | | | | | | Without this fix calling `jQuery.uniqueSort` on an array-like can result in: TypeError: results.splice is not a function at Function.jQuery.uniqueSort (https://code.jquery.com/jquery-git.js:664:12) at jQuery.fn.init.find (https://code.jquery.com/jquery-git.js:2394:27) at gocusihafe.js:3:4 Closes gh-4986
* Docs: Fix incorrect `trac-NUMBER` referencesMichał Gołębiowski-Owczarek2022-01-127-8/+8
| | | | | | | | PR gh-4993 changed a few too many issue references to `trac-NUMBER` ones. This change fixes them. It also fixes a typo in one Trac issue number in selector tests. Ref gh-4993 Closes gh-4995
* Docs: remove expired links from old jquery source (#4997)Timmy Willison2022-01-071-2/+0
| | | | Ref gh-4981 Ref gh-4991
* Docs: Replace `#NUMBER` Trac issue references with `trac-NUMBER`Michał Gołębiowski-Owczarek2022-01-0429-352/+353
| | | | | | | | | | | | | The GitHub UI treats `#NUMBER` as referring to its own issues which is confusing when in jQuery source it's usually referring to the old deprecated Trac instance at https://bugs.jquery.com. This change replaces all such Trac references with `trac-NUMBER`. A few of the references came with the Sizzle integration and referred to the Sizzle GitHub bug tracker. Those have been replaced with full links instead. A new entry describing issue reference conventions has been added to README. Closes gh-4993
* Tests: Skip ETag AJAX tests on TestSwarmMichał Gołębiowski-Owczarek2021-12-011-5/+18
| | | | | | | TestSwarm is now proxied via Cloudflare which cuts out headers relevant for ETag tests, failing them. We're still running those tests in Karma on Chrome & Firefox (including Firefox ESR). Closes gh-4974
* Tests: Allow statusText to be "success" in AJAX testsMichał Gołębiowski-Owczarek2021-12-011-1/+2
| | | | | | | | | | | | In HTTP/2, status message is not supported and whatever is reported as statusText differs between browsers. In Chrome & Safari it's "success", in Firefox & IE it's "OK". So far "success" wasn't allowed. This made the tests pass locally if you're running an HTTP/1.1 server but on TestSwarm which is now proxied via an HTTP/2-equipped Cloudflare, the relevant test started failing in Chrome & Safari. Allow "success" to resolve the issue. Closes gh-4973
* Attributes: Don't stringify attributes in the setterMichał Gołębiowski-Owczarek2021-11-015-0/+96
| | | | | | | | | | | | | Stringifying attributes in the setter was needed for IE <=9 but it breaks trusted types enforcement when setting a script `src` attribute. Note that this doesn't mean script execution works. Since jQuery disables all scripts by changing their type and then executes them by creating fresh script tags with proper `src` & possibly other attributes, this unwraps any trusted `src` wrappers, making the script not execute under strict CSP settings. We might try to fix it in the future in a separate change. Fixes gh-4948 Closes gh-4949
* Core:Manipulation: Add basic TrustedHTML supportMichał Gołębiowski-Owczarek2021-09-306-4/+110
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This ensures HTML wrapped in TrustedHTML can be used as an input to jQuery manipulation methods in a way that doesn't violate the `require-trusted-types-for` Content Security Policy directive. This commit builds on previous work needed for trusted types support, including gh-4642 and gh-4724. One restriction is that while any TrustedHTML wrapper should work as input for jQuery methods like `.html()` or `.append()`, for passing directly to the `jQuery` factory the string must start with `<` and end with `>`; no trailing or leading whitespaces are allowed. This is necessary as we cannot parse out a part of the input for further construction; that would violate the CSP rule - and that's what's done to HTML input not matching these constraints. No trusted types API is used explicitly in source; the majority of the work is ensuring we don't pass the input converted to string to APIs that would eventually assign it to `innerHTML`. This extra cautiousness is caused by the API being Blink-only, at least for now. The ban on passing strings to `innerHTML` means support tests relying on such assignments are impossible. We don't currently have such tests on the `main` branch but we used to have many of them in the 3.x & older lines. If there's a need to re-add such a test, we'll need an escape hatch to skip them for apps needing CSP-enforced TrustedHTML. See https://web.dev/trusted-types/ for more information about TrustedHTML. Fixes gh-4409 Closes gh-4927 Ref gh-4642 Ref gh-4724
* Tests: Don't remove csp.log in the cspClean action of mock.phpMichał Gołębiowski-Owczarek2021-09-301-1/+0
| | | | | | For some reason the current setup worked fine with Apache but broke for me when I migrated to nginx. Closes gh-4936
* Tests: Load the TestSwarm listener via HTTPSMichał Gołębiowski-Owczarek2021-09-291-1/+1
|
* CSS: Trim whitespace surrounding CSS Custom Properties valuesfecore12021-09-231-8/+23
| | | | | | | | The spec has recently changed and CSS Custom Properties values are trimmed now. This change makes jQuery polyfill that new behavior for all browsers. Ref w3c/csswg-drafts#774 Fixes gh-4926 Closes gh-4930
* Manipulation: Don't remove HTML comments from scriptsMichał Gołębiowski-Owczarek2021-07-192-8/+20
| | | | | | | | | | | | | | | | | | | When evaluating scripts, jQuery strips out the possible wrapping HTML comment and a CDATA section. However, all supported browsers are already doing that when loading JS via appending a script tag to the DOM which is how we've been doing `jQuery.globalEval` since jQuery 3.0.0. jQuery logic was imperfect, e.g. it just stripped the `<!--` and `-->` markers, respectively at the beginning or the end of the script contents. However, browsers are also stripping everything following those markers in the same line, treating them as single-line comments delimiters; this is now also mandated by ECMAScript 2015 in Annex B. Instead of fixing the jQuery logic, just let the browser do its thing. We also used to strip CDATA sections. However, this shouldn't be needed as in XML documents they're already not visible when inspecting element contents and in HTML documents they have no meaning. We've preserved that behavior for backwards compatibility in 3.x but we're removing it for 4.0. Fixes gh-4904 Closes gh-4906
* Tests: Switch background image from online file to local 1x1.jpgTimo Tijhof2021-05-242-19/+9
| | | | | Also, remove unused `expected` property in `css` test cases. Closes gh-4866
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-30 14:30:27 +0000