Christopher Tubbs
8 years ago
parent
18b7d13fc6
commit
034fe58098
@ -1,3 +1,4 @@
|
||||
/js-jquery-4dec426aa2a6cbabb1b064319ba7c272d594a688.tar.gz
|
||||
/js-jquery-8f2a9d9272d6ed7f32d3a484740ab342c02541e0.tar.gz
|
||||
/jquery-2.2.4.tar.gz
|
||||
/jquery-3.2.1.tar.gz
|
||||
|
||||
@ -0,0 +1,60 @@
|
||||
diff --git a/build/tasks/build.js b/build/tasks/build.js
|
||||
index 69916bf..58e65ad 100644
|
||||
--- a/build/tasks/build.js
|
||||
+++ b/build/tasks/build.js
|
||||
@@ -10,7 +10,6 @@ module.exports = function( grunt ) {
|
||||
|
||||
var fs = require( "fs" ),
|
||||
requirejs = require( "requirejs" ),
|
||||
- Insight = require( "insight" ),
|
||||
pkg = require( "../../package.json" ),
|
||||
srcFolder = __dirname + "/../../src/",
|
||||
rdefineEnd = /\}\s*?\);[^}\w]*$/,
|
||||
@@ -337,46 +336,16 @@ module.exports = function( grunt ) {
|
||||
grunt.registerTask( "custom", function() {
|
||||
var args = this.args,
|
||||
modules = args.length ? args[ 0 ].replace( /,/g, ":" ) : "",
|
||||
- done = this.async(),
|
||||
- insight = new Insight( {
|
||||
- trackingCode: "UA-1076265-4",
|
||||
- pkg: pkg
|
||||
- } );
|
||||
+ done = this.async();
|
||||
|
||||
function exec( trackingAllowed ) {
|
||||
- var tracks = args.length ? args[ 0 ].split( "," ) : [];
|
||||
var defaultPath = [ "build", "custom" ];
|
||||
|
||||
- tracks = tracks.map( function( track ) {
|
||||
- return track.replace( /\//g, "+" );
|
||||
- } );
|
||||
-
|
||||
- if ( trackingAllowed ) {
|
||||
-
|
||||
- // Track individuals
|
||||
- tracks.forEach( function( module ) {
|
||||
- var path = defaultPath.concat( [ "individual" ], module );
|
||||
-
|
||||
- insight.track.apply( insight, path );
|
||||
- } );
|
||||
-
|
||||
- // Track full command
|
||||
- insight.track.apply( insight, defaultPath.concat( [ "full" ], tracks ) );
|
||||
- }
|
||||
-
|
||||
grunt.task.run( [ "build:*:*" + ( modules ? ":" + modules : "" ), "uglify", "dist" ] );
|
||||
done();
|
||||
}
|
||||
|
||||
grunt.log.writeln( "Creating custom build...\n" );
|
||||
|
||||
- // Ask for permission the first time
|
||||
- if ( insight.optOut === undefined ) {
|
||||
- insight.askPermission( null, function( error, result ) {
|
||||
- exec( result );
|
||||
- } );
|
||||
- } else {
|
||||
- exec( !insight.optOut );
|
||||
- }
|
||||
} );
|
||||
};
|
||||
@ -1,11 +1,14 @@
|
||||
diff --git a/Gruntfile.js b/Gruntfile.js
|
||||
index 12ae008..5d541f2 100644
|
||||
--- a/Gruntfile.js
|
||||
+++ b/Gruntfile.js
|
||||
@@ -13,7 +13,6 @@ module.exports = function( grunt ) {
|
||||
@@ -12,8 +12,7 @@ module.exports = function( grunt ) {
|
||||
return data;
|
||||
}
|
||||
|
||||
var fs = require( "fs" ),
|
||||
stripJSONComments = require( "strip-json-comments" ),
|
||||
- gzip = require( "gzip-js" ),
|
||||
srcHintOptions = readOptionalJSON( "src/.jshintrc" ),
|
||||
newNode = !/^v0/.test( process.version ),
|
||||
- var fs = require( "fs" ),
|
||||
- gzip = require( "gzip-js" );
|
||||
+ var fs = require( "fs" );
|
||||
|
||||
if ( !grunt.option( "filename" ) ) {
|
||||
grunt.option( "filename", "jquery.js" );
|
||||
|
||||
@ -1 +1 @@
|
||||
SHA512 (jquery-2.2.4.tar.gz) = bd1176286451adeaa8c18eb98e01e8b91e45157f7263907772d637a2c15b8ac27b780be14983c4abcff5def668323beab9a6889d8da4beb6c2c06fae1f5bed1d
|
||||
SHA512 (jquery-3.2.1.tar.gz) = c237b4de4e7d31cde8f8de2493ae92f7db1d504b83f24808738066bdaa7c906f3b6f819eeff1bb90881cbbccd1d32fbc06f63e847c13548adc92671d796bf336
|
||||
|
||||
@ -1,91 +0,0 @@
|
||||
From b078a62013782c7424a4a61a240c23c4c0b42614 Mon Sep 17 00:00:00 2001
|
||||
From: Oleg Gaidarenko <markelog@gmail.com>
|
||||
Date: Thu, 10 Sep 2015 13:40:00 +0300
|
||||
Subject: [PATCH] Ajax: Mitigate possible XSS vulnerability
|
||||
|
||||
Proposed by @jaubourg
|
||||
|
||||
Fixes gh-2432
|
||||
Closes gh-2588
|
||||
---
|
||||
src/ajax/script.js | 7 +++++++
|
||||
test/unit/ajax.js | 48 ++++++++++++++++++++++++++++++++++++++++++++++++
|
||||
2 files changed, 55 insertions(+), 0 deletion(-)
|
||||
|
||||
diff --git a/src/ajax/script.js b/src/ajax/script.js
|
||||
index 60b1fb6..0ec27b4 100644
|
||||
--- a/src/ajax/script.js
|
||||
+++ b/src/ajax/script.js
|
||||
@@ -4,6 +4,13 @@ define( [
|
||||
"../ajax"
|
||||
], function( jQuery, document ) {
|
||||
|
||||
+// Prevent auto-execution of scripts when no explicit dataType was provided (See gh-2432)
|
||||
+jQuery.ajaxPrefilter( function( s ) {
|
||||
+ if ( s.crossDomain ) {
|
||||
+ s.contents.script = false;
|
||||
+ }
|
||||
+} );
|
||||
+
|
||||
// Install script dataType
|
||||
jQuery.ajaxSetup( {
|
||||
accepts: {
|
||||
diff --git a/test/unit/ajax.js b/test/unit/ajax.js
|
||||
index 14fe0be..6479587 100644
|
||||
--- a/test/unit/ajax.js
|
||||
+++ b/test/unit/ajax.js
|
||||
@@ -71,6 +71,54 @@ QUnit.module( "ajax", {
|
||||
};
|
||||
} );
|
||||
|
||||
+ ajaxTest( "jQuery.ajax() - do not execute js (crossOrigin)", 2, function( assert ) {
|
||||
+ return {
|
||||
+ create: function( options ) {
|
||||
+ options.crossDomain = true;
|
||||
+ return jQuery.ajax( url( "data/script.php?header=ecma" ), options );
|
||||
+ },
|
||||
+ success: function() {
|
||||
+ assert.ok( true, "success" );
|
||||
+ },
|
||||
+ complete: function() {
|
||||
+ assert.ok( true, "complete" );
|
||||
+ }
|
||||
+ };
|
||||
+ } );
|
||||
+
|
||||
+ ajaxTest( "jQuery.ajax() - execute js for crossOrigin when dataType option is provided", 3,
|
||||
+ function( assert ) {
|
||||
+ return {
|
||||
+ create: function( options ) {
|
||||
+ options.crossDomain = true;
|
||||
+ options.dataType = "script";
|
||||
+ return jQuery.ajax( url( "data/script.php?header=ecma" ), options );
|
||||
+ },
|
||||
+ success: function() {
|
||||
+ assert.ok( true, "success" );
|
||||
+ },
|
||||
+ complete: function() {
|
||||
+ assert.ok( true, "complete" );
|
||||
+ }
|
||||
+ };
|
||||
+ }
|
||||
+ );
|
||||
+
|
||||
+ ajaxTest( "jQuery.ajax() - do not execute js (crossOrigin)", 2, function( assert ) {
|
||||
+ return {
|
||||
+ create: function( options ) {
|
||||
+ options.crossDomain = true;
|
||||
+ return jQuery.ajax( url( "data/script.php" ), options );
|
||||
+ },
|
||||
+ success: function() {
|
||||
+ assert.ok( true, "success" );
|
||||
+ },
|
||||
+ complete: function() {
|
||||
+ assert.ok( true, "complete" );
|
||||
+ }
|
||||
+ };
|
||||
+ } );
|
||||
+
|
||||
ajaxTest( "jQuery.ajax() - success callbacks (late binding)", 8, function( assert ) {
|
||||
return {
|
||||
setup: addGlobalEvents( "ajaxStart ajaxStop ajaxSend ajaxComplete ajaxSuccess", assert ),
|
||||
Loading…
Reference in new issue