🌐 AI搜索 & 代理 主页
Skip to content

Commit 0050403

Browse files
buddh4mgol
buddh4
authored and
mgol
committed
Core: Preserve CSP nonce on scripts with src attribute in DOM manipulation
Fixes gh-4323 Closes gh-4328
1 parent fe5f04d commit 0050403

File tree

5 files changed

+46
-3
lines changed

5 files changed

+46
-3
lines changed

‎src/manipulation.js‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -199,7 +199,9 @@ function domManip( collection, args, callback, ignored ) {
199199

200200
// Optional AJAX dependency, but won't run scripts if not present
201201
if ( jQuery._evalUrl && !node.noModule ) {
202-
jQuery._evalUrl( node.src );
202+
jQuery._evalUrl( node.src, {
203+
nonce: node.nonce || node.getAttribute( "nonce" )
204+
} );
203205
}
204206
} else {
205207
DOMEval( node.textContent.replace( rcleanScript, "" ), node, doc );

‎src/manipulation/_evalUrl.js‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ define( [
44

55
"use strict";
66

7-
jQuery._evalUrl = function( url ) {
7+
jQuery._evalUrl = function( url, options ) {
88
return jQuery.ajax( {
99
url: url,
1010

@@ -22,7 +22,7 @@ jQuery._evalUrl = function( url ) {
2222
"text script": function() {}
2323
},
2424
dataFilter: function( response ) {
25-
jQuery.globalEval( response );
25+
jQuery.globalEval( response, options );
2626
}
2727
} );
2828
};

‎test/data/csp-nonce-external.html‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
<!DOCTYPE html>
2+
<html>
3+
<head>
4+
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
5+
<title>CSP nonce via jQuery.globalEval Test Page</title>
6+
<script nonce="jquery+hardcoded+nonce" src="../jquery.js"></script>
7+
<script nonce="jquery+hardcoded+nonce" src="iframeTest.js"></script>
8+
<script nonce="jquery+hardcoded+nonce" src="csp-nonce-external.js"></script>
9+
</head>
10+
<body>
11+
<p>CSP nonce for external script Test Page</p>
12+
</body>
13+
</html>

‎test/data/csp-nonce-external.js‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
/* global startIframeTest */
2+
3+
jQuery( function() {
4+
$( "body" ).append( "<script nonce='jquery+hardcoded+nonce' src='csp-nonce.js'></script>" );
5+
} );

‎test/unit/manipulation.js‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2894,6 +2894,29 @@ testIframe(
28942894
QUnit[ /\bedge\/|iphone os [789]|android 4\./i.test( navigator.userAgent ) ? "skip" : "test" ]
28952895
);
28962896

2897+
testIframe(
2898+
"Check if CSP nonce is preserved for external scripts with src attribute",
2899+
"mock.php?action=cspNonce&test=external",
2900+
function( assert, jQuery, window, document ) {
2901+
var done = assert.async();
2902+
2903+
assert.expect( 1 );
2904+
2905+
supportjQuery.get( baseURL + "support/csp.log" ).done( function( data ) {
2906+
assert.equal( data, "", "No log request should be sent" );
2907+
supportjQuery.get( baseURL + "mock.php?action=cspClean" ).done( done );
2908+
} );
2909+
},
2910+
2911+
// Support: Edge 18+, iOS 7-9 only, Android 4.0-4.4 only
2912+
// Edge doesn't support nonce in non-inline scripts.
2913+
// See https://developer.microsoft.com/en-us/microsoft-edge/platform/issues/13246371/
2914+
// Old iOS & Android Browser versions support script-src but not nonce, making this test
2915+
// impossible to run. Browsers not supporting CSP at all are not a problem as they'll skip
2916+
// script-src restrictions completely.
2917+
QUnit[ /\bedge\/|iphone os [789]|android 4\./i.test( navigator.userAgent ) ? "skip" : "test" ]
2918+
);
2919+
28972920
testIframe(
28982921
"jQuery.globalEval supports nonce",
28992922
"mock.php?action=cspNonce&test=globaleval",

0 commit comments

Comments
 (0)