Commit Graph

291 Commits

Author SHA1 Message Date
Michał Gołębiowski-Owczarek
5318e3111a Selector:Manipulation: Fix DOM manip within template contents
The `<template/>` element `contents` property is a document fragment that may
have a `null` `documentElement`. In Safari 16 this happens in more cases due
to recent spec changes - in particular, even if that document fragment is
explicitly adopted into an outer document. We're testing both of those cases
now.

The crash used to happen in `jQuery.contains` which is an alias for
`Sizzle.contains` in jQuery 3.x.

The Sizzle fix is at jquery/sizzle#490, released in Sizzle `2.3.8`. This
version of Sizzle is included in the parent commit.

A fix similar to the one from gh-5158 has also been applied here to the
`selector-native` version.

Fixes gh-5147
Closes gh-5159
Ref jquery/sizzle#490
Ref gh-5158
2022-11-16 23:58:17 +01:00
Michał Gołębiowski-Owczarek
bc16512879
Tests: Exclude tests based on compilation flags, not API presence (3.x version)
Introduces a new test API, `includesModule`. The method returns whether
a particular module like "ajax" or "deprecated" is included in the current
jQuery build; it handles the slim build as well. The util was created so that
we don't treat presence of particular APIs to decide whether to run a test as
then if we accidentally remove an API, the tests would still not fail.

Closes gh-5071
Fixes gh-5069
Ref gh-5046

(partially cherry picked from commit fae5fee8b4)
2022-07-12 17:12:27 +02:00
Michał Gołębiowski-Owczarek
95e34b6955
Docs: Replace #NUMBER Trac issue references with trac-NUMBER
This is a version of gh-4993 for the `3.x-stable` branch.

The GitHub UI treats `#NUMBER` as referring to its own issues which is confusing
when in jQuery source it's usually referring to the old deprecated Trac instance
at https://bugs.jquery.com. This change replaces all such Trac references with
`trac-NUMBER`.

A few of the references came with the Sizzle integration and referred to the
Sizzle GitHub bug tracker. Those have been replaced with full links instead.

A new entry describing issue reference conventions has been added to README.

Closes gh-4994
Ref gh-4993
Ref 5d5ea01511
2022-01-12 23:23:10 +01:00
Michał Gołębiowski-Owczarek
924b515dd3
Manipulation: Don't remove HTML comments from scripts
When evaluating scripts, jQuery strips out the possible wrapping HTML comment
and a CDATA section. However, all supported browsers are already doing that
when loading JS via appending a script tag to the DOM which is how we've been
doing `jQuery.globalEval` since jQuery 3.0.0. jQuery logic was imperfect, e.g.
it just stripped the `<!--` and `-->` markers, respectively at the beginning or
the end of the script contents. However, browsers are also stripping everything
following those markers in the same line, treating them as single-line comments
delimiters; this is now also mandated by ECMAScript 2015 in Annex B. Instead
of fixing the jQuery logic, just let the browser do its thing.

We still need to strip CDATA sections for backwards compatibility. This
shouldn't be needed as in XML documents they're already not visible when
inspecting element contents and in HTML documents they have no meaning but
we're preserving that logic for backwards compatibility. This will be removed
completely in 4.0.

Fixes gh-4904
Closes gh-4905
Ref gh-4906
2021-07-19 19:15:27 +02:00
Michał Gołębiowski-Owczarek
ea2d0d50c0 Tests: Workaround failures in recent XSS tests in iOS 8 - 12
iOS 8-12 parses `<noembed>` tags differently, executing this code. This is no
different to native behavior on that OS, though, so just accept it.

Ref gh-4685
Closes gh-4694

(cherry picked from commit 11066a9e6a)
2020-04-30 21:26:18 +02:00
Pierre Grimaud
ea3766c081 Docs: Fix typos
Closes gh-4686

(cherry picked from commit 1a7332ce83)
2020-04-29 21:18:55 +02:00
Michał Gołębiowski-Owczarek
58a8e87979 Tests: Add tests for recently fixed manipulation XSS issues
Closes gh-4685
Ref gh-4642
Ref gh-4647

(cherry picked from commit dc06d68bdc)
2020-04-29 16:50:27 +02:00
Michał Gołębiowski-Owczarek
1d61fd9407 Manipulation: Make jQuery.htmlPrefilter an identity function
Closes gh-4642

(cherry picked from 90fed4b453)
2020-03-16 21:59:49 +01:00
Michał Gołębiowski-Owczarek
3dedc3f2d4 Core: Fire iframe script in its context, add doc param in globalEval
1. Support passing custom document to jQuery.globalEval; the script will be
   invoked in the context of this document.
2. Fire external scripts appended to iframe contents in that iframe context;
   this was already supported & tested for inline scripts but not for external
   ones.

Fixes gh-4518
Closes gh-4601

(cherry picked from commit 4592595b47)
2020-02-10 19:20:50 +01:00
Michał Gołębiowski-Owczarek
d525ae3416
Build:Tests: Fix custom build tests, verify on Travis; name Travis jobs
This commit fixes unit tests for the following builds:

1. The no-deprecated build: `custom:-deprecated`
2. The current slim build: `custom:-ajax,-effects`
3. The 4.0 (#4553) slim build: `custom:-ajax,-callbacks,-deferred,-effects`

It also adds separate Travis jobs for the no-deprecated & slim builds.

Apart from that, add intuitive names to Travis jobs. Otherwise it's hard to see
at a glance that a particular job is running on Firefox ESR, for example.

Ref gh-4577
Ref gh-4596
Closes gh-4600
2020-01-27 18:54:47 +01:00
Michał Gołębiowski-Owczarek
d72faced11 Docs: Update links to EdgeHTML issues to go through Web Archive
With Microsoft going Chromium with Edge, its old EdgeHTML issues were all
removed. :(

The commit also reformats one manipulation unit test to use tabs instead
of spaces for indentation.

(partially cherry-picked from 1dad1185e0)

Closes gh-4584
2020-01-08 01:30:30 +01:00
buddh4
005040379d Core: Preserve CSP nonce on scripts with src attribute in DOM manipulation
Fixes gh-4323
Closes gh-4328
2019-03-25 18:14:24 +01:00
Michał Gołębiowski-Owczarek
6ced2639b5
Build: Update QUnit from 1.23.1 to 2.9.2
Closes gh-4307
2019-03-04 20:10:21 +01:00
abnud1
c349818742 Build: Update test code for compatibility with QUnit 2.x (#4297)
Also, run `grunt npmcopy` to sync the "external" directory with dependencies
from package.json. For example, the Sinon library version didn't match.

Ref gh-4234
Closes gh-4297
2019-02-18 19:03:26 +01:00
Michał Gołębiowski-Owczarek
5bdc85b82b
Core: Support passing nonce through jQuery.globalEval
Fixes gh-4278
Closes gh-4280
Ref gh-3541
Ref gh-4269
2019-01-21 18:42:39 +01:00
Michał Gołębiowski-Owczarek
e4de8b4626
Manipulation: Respect script nomodule attribute in DOM manipulation
PR #3869 added support for `<script type="module">` & some support for
the `nomodule` attribute but with no tests for `nomodule` and with the
attribute only respected on inline scripts. This commit adds support for
source-based scripts as well. It also adds tests for `nomodule`, including
making sure legacy browsers execute such scripts as they'd natively do - that's
the whole point of `nomodule` scripts, after all.

Fixes gh-4281
Closes gh-4282
Ref gh-3871
Ref gh-3869
2019-01-21 18:34:40 +01:00
Michał Gołębiowski-Owczarek
543d3d24ea Tests: Skip nonce tests in old iOS/Android as well
Old iOS & Android Browser versions support script-src but not nonce, making the
nonce test impossible to run. Browsers not supporting CSP at all are not
a problem as they'll skip script-src restrictions completely.

Ref gh-3541
Ref gh-4269
Ref c7c2855ed1
2019-01-14 19:49:28 +01:00
Michał Gołębiowski-Owczarek
c7c2855ed1
Core: Preserve CSP nonce on scripts in DOM manipulation
Fixes gh-3541
Closes gh-4269
2019-01-14 19:29:54 +01:00
Richard Gibson
c2026b117d Manipulation: Only evaluate HTTP-successful script src
Fixes gh-4126
Closes gh-4243
2018-12-12 17:21:24 +01:00
Michał Gołębiowski-Owczarek
ae82e85e64
Tests: Skip module tests in Edge
Edge sometimes doesn't execute module scripts. It needs to be investigated why
but for now, we're skipping the test to make our tests more stable.

Closes gh-4140
2018-07-30 18:41:08 +02:00
Richard Gibson
979809c5a8
Manipulation: Properly detect HTML elements with single-character names
Fixes gh-4124
Closes gh-4125
2018-07-13 00:35:08 -04:00
Timmy Willison
625e19cd9b
Tests: ensure that module assertions run on supported browsers
- Also fixes tests for karma, where the URL for the module is different

Ref gh-3871
2018-01-16 15:18:32 -05:00
basil.belokon
5d3a968e03
Manipulation: Add support for scripts with module type
Fixes gh-3871
Close gh-3869
2018-01-16 11:39:16 -05:00
Jason Bedard
3d732cca6b Core: deprecate jQuery.isFunction
Fixes gh-3609
2018-01-15 09:26:19 -08:00
Timo Tijhof
ecd8ddea33
Tests: Add support for running unit tests via grunt with karma
- Update QUnit to 1.23.1
- Remove unused dl#dl from test/index.html
- Remove unused map#imgmap from test/index.html
- Ensure all urls to data use baseURI
- Add the 'grunt karma:main' task
  - customContextFile & customDebugFile
- Add 'npm run jenkins' script

Close gh-3744
Fixes gh-1999
2017-12-18 12:27:38 -05:00
Andreas Solleder
5bdd1ca1ab
Tests: minor typos
Close gh-3671
2017-06-05 11:46:43 -04:00
karan-96
ac9e301664 Core: Deprecate jQuery.nodeName
Fixes gh-3475
Closes gh-3505
2017-03-01 11:48:11 +01:00
Richard Gibson
efdb8a46e4 Manipulation: Restrict the tbody search to child nodes
For performance, use a querySelectorAll path instead of Javascript iteration.
http://codepen.io/anon/pen/vywJjx?editors=1010

Fixes gh-3439
Closes gh-3463
2017-01-09 11:37:12 -08:00
Oleg Gaidarenko
522f546d96 Build: More ESLint related changes 2016-07-09 00:49:43 +03:00
Oleg Gaidarenko
58c6ca9822 Build: ESLint details
Use eslint pragmas, fix new errors, etc

Closes gh-3148
2016-06-11 10:41:33 +03:00
Dave Methvin
e5ffcb0838 Tests: Refactor testIframe() to make it DRYer and more consistent
Ref gh-3040
Closes gh-3049
2016-04-11 13:32:51 -04:00
Michał Gołębiowski
9b086888b8 Docs:Tests: Remove obsolete code from tests, update support comments
Support comments that were lacking the final IE/Edge version that exhibits
the bug were checked & updated. Links to the Chromium bug tracker were updated.
Code in tests related to unsupported browsers (like Android 2.3 in non-basic
tests) has been removed.

Fixes gh-2868
Closes gh-2949
2016-03-08 23:26:46 +01:00
Michał Gołębiowski
0b0d4c634a Tests: Fix manipulation tests in Android 4.4
Chromium < 35 incorrectly upper-cases µ; Android 4.4 uses such a version by
default (and its WebView, being un-updatable, will use it for eternity) so we
need to blacklist that one for the tests to pass.
2016-01-27 12:02:00 +01:00
Jon Dufresne
b0b280cd61 Docs: Updated links to https where they are supported.
Close gh-2746
2016-01-13 13:26:10 -05:00
Josh Soref
aae44111e2 Docs: Fix various spelling errors
Closes gh-2761
2016-01-13 13:11:11 -05:00
Leonardo Braga
fb9472c7fb Manipulation: Bring tagname regexes up to spec
Fixes gh-2005
Closes gh-2634
2016-01-07 16:48:49 -05:00
Timmy Willison
88046440da Selector: pass jQuery unit tests with selector-native
- Ignore certain tests that obviously are not supported
- Beefed up the sortOrder, uniqueSort, isXMLDoc, and attr functions

Fixes gh-1742
Fixes gh-2048
Close gh-2703
2015-11-11 10:10:10 -05:00
Timmy Willison
22449eb968 Manipulation: execute scripts from iframe in the iframe's context
Fixes gh-1757
Close gh-2696
2015-11-09 14:14:30 -05:00
Jason Bedard
0e982433eb Data: avoid using delete on DOM nodes
Closes gh-2479
2015-09-08 20:22:54 +02:00
Oleg Gaidarenko
c8d15a2f9f Tests: further improvements QUnit 2.0 migration
* Remove QUnit jshint globals
* Extend QUnit.assert methods
* Use assert.async instead of start/stop/done

Ref b930d14ce6
2015-09-08 04:06:20 +03:00
Oleg Gaidarenko
10fdad742a Build: Update jscs and lint files
Fixes gh-2056
2015-09-07 20:03:50 +03:00
Oleg Gaidarenko
b930d14ce6 Tests: partially use new qunit interface
http://qunitjs.com/upgrade-guide-2.x/

For most of the boring work was used
https://github.com/apsdehal/qunit-migrate package

However, it can't update local qunit helpers, plus in some places
old QUnit.asyncTest signature is still used

Fixes gh-2540
2015-08-16 09:02:01 +03:00
Oleg Gaidarenko
aabe94edb4 Tests: don't use deprecated argument in test declaration
Closes gh-2507
2015-07-30 20:46:31 +03:00
Bruno Pérel
360a478033 Docs: Fix various spelling mistakes
Closes gh-2487
2015-07-30 15:47:23 +02:00
Jason Bedard
5fe76c663f Data: remove user data in cleanData
Fixes gh-2503
Closes gh-2480
2015-07-28 14:22:03 +02:00
Michał Gołębiowski
6044fb6a73 Ajax: Account for Android 2.3 not firing window.onerror on script errors
Android 2.3 doesn't fire the window.onerror handler, just accept the reality
there and skip the test.

Refs gh-1573
Refs gh-1786
Refs jquery/jquery.com#108
Closes gh-2458
2015-07-28 13:20:20 +02:00
Richard Gibson
225bde37c9 Manipulation: Make an HTML interception point
Fixes gh-1747
Closes gh-2203
2015-04-30 13:15:33 -04:00
Richard Gibson
4b27ae16a2 Manipulation: Detect sneaky no-content replaceWith input
Fixes gh-2204
Ref 642e9a4557
Closes gh-1752
Closes gh-2206
2015-04-30 11:36:38 -04:00
Rick Waldron
332fd941b4 Data: restore explicit data removal of private data in cleanData.
Fixes gh-2127
Closes gh-2132
2015-03-09 13:51:16 -04:00
Rick Waldron
d702b7637a Data: move element cache to element[expando]
- avoid explicit data.discard() cleanup calls
- explicitly remove the data.events property, only when private data exists
- reduces code footprint

Fixes gh-1734
Close gh-1428
2015-03-04 17:26:47 -05:00