From 025da4dd343e6734f3d3c1b4785b1548498115d8 Mon Sep 17 00:00:00 2001 From: Michał Gołębiowski-Owczarek Date: Tue, 26 Jan 2021 15:58:29 +0100 Subject: Ajax: Don't auto-execute scripts unless dataType provided PR gh-2588 made jQuery stop auto-execute cross-domain scripts unless `dataType: "script"` was explicitly provided; this change landed in jQuery 3.0.0. This change extends that logic same-domain scripts as well. After this change, to request a script under a provided URL to be evaluated, you need to provide `dataType: "script` in `jQuery.ajax` options or to use `jQuery.getScript`. Fixes gh-4822 Closes gh-4825 Ref gh-2432 Ref gh-2588 --- src/ajax/script.js | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-) (limited to 'src') diff --git a/src/ajax/script.js b/src/ajax/script.js index 203ea08e0..fee8a66e0 100644 --- a/src/ajax/script.js +++ b/src/ajax/script.js @@ -19,22 +19,13 @@ function canUseScriptTag( s ) { ( s.async && jQuery.inArray( "json", s.dataTypes ) < 0 ); } -// Prevent auto-execution of scripts when no explicit dataType was provided (See gh-2432) -jQuery.ajaxPrefilter( function( s ) { - if ( s.crossDomain ) { - s.contents.script = false; - } -} ); - -// Install script dataType +// Install script dataType. Don't specify `content.script` so that an explicit +// `dataType: "script"` is required (see gh-2432, gh-4822) jQuery.ajaxSetup( { accepts: { script: "text/javascript, application/javascript, " + "application/ecmascript, application/x-ecmascript" }, - contents: { - script: /\b(?:java|ecma)script\b/ - }, converters: { "text script": function( text ) { jQuery.globalEval( text ); -- cgit v1.2.3