diff options
Diffstat (limited to 'core/js/js.js')
| -rw-r--r-- | core/js/js.js | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/core/js/js.js b/core/js/js.js index 8d3756ae2ec..de773dc1221 100644 --- a/core/js/js.js +++ b/core/js/js.js @@ -1215,6 +1215,20 @@ function object(o) { * Initializes core */ function initCore() { + /** + * Disable automatic evaluation of responses for $.ajax() functions (and its + * higher-level alternatives like $.get() and $.post()). + * + * If a response to a $.ajax() request returns a content type of "application/javascript" + * JQuery would previously execute the response body. This is a pretty unexpected + * behaviour and can result in a bypass of our Content-Security-Policy as well as + * multiple unexpected XSS vectors. + */ + $.ajaxSetup({ + contents: { + script: false + } + }); /** * Set users locale to moment.js as soon as possible |