Core: use document.implemenation.createHTMLDocument in jQuery.parseHTML

fhemberger · markelog · commit d23a95f9c6d4 · 2015-11-10T20:51:30.000+03:00
Close gh-1505
diff --git a/src/core.js b/src/core.js
@@ -7,7 +7,7 @@ define([
 	"./var/class2type",
 	"./var/toString",
 	"./var/hasOwn",
-	"./var/support"
+	"./core/support"
 ], function( arr, slice, concat, push, indexOf, class2type, toString, hasOwn, support ) {
 
 var
diff --git a/src/core/parseHTML.js b/src/core/parseHTML.js
@@ -2,7 +2,7 @@ define([
 	"../core",
 	"./var/rsingleTag",
 	"../manipulation" // buildFragment
-], function( jQuery, rsingleTag ) {
+], function( jQuery, rsingleTag, support ) {
 
 // data: string of html
 // context (optional): If specified, the fragment will be created in this context,
@@ -16,7 +16,11 @@ jQuery.parseHTML = function( data, context, keepScripts ) {
 		keepScripts = context;
 		context = false;
 	}
-	context = context || document;
+	// document.implementation stops scripts or inline event handlers from
+	// being executed immediately
+	context = context || ( support.createHTMLDocument ?
+		document.implementation.createHTMLDocument() :
+		document );
 
 	var parsed = rsingleTag.exec( data ),
 		scripts = !keepScripts && [];
diff --git a/src/core/support.js b/src/core/support.js
@@ -0,0 +1,6 @@
+define([
+	"../var/support"
+], function( jQuery, support ) {
+	// window.document is used here as it's before the sandboxed document
+	support.createHTMLDocument = !!window.document.implementation.createHTMLDocument;
+});
diff --git a/test/unit/core.js b/test/unit/core.js
@@ -1349,6 +1349,24 @@ test("jQuery.parseHTML", function() {
 	ok( jQuery.parseHTML("<#if><tr><p>This is a test.</p></tr><#/if>") || true, "Garbage input should not cause error" );
 });
 
+// This XSS test is optional, as it will only pass when `document.implementation.createHTMLDocument`
+// is implemented. This might not be the case for older Android browsers (<= 2.x).
+if ( document.implementation.createHTMLDocument ) {
+	asyncTest("jQuery.parseHTML", function() {
+		expect ( 1 );
+
+		Globals.register("parseHTMLError");
+
+		jQuery.globalEval("parseHTMLError = false;");
+		jQuery.parseHTML( "<img src=x onerror='parseHTMLError = true'>" );
+
+		window.setTimeout(function() {
+			start();
+			equal( window.parseHTMLError, false, "onerror eventhandler has not been called." );
+		}, 2000);
+	});
+}
+
 test("jQuery.parseJSON", function() {
 	expect( 20 );
 
diff --git a/test/unit/support.js b/test/unit/support.js
@@ -61,6 +61,7 @@ testIframeWithCallback( "Check CSP (https://developer.mozilla.org/en-US/docs/Sec
 			"checkOn": true,
 			"clearCloneStyle": true,
 			"cors": true,
+			"createHTMLDocument": true,
 			"focusinBubbles": false,
 			"noCloneChecked": true,
 			"optDisabled": true,
@@ -77,6 +78,7 @@ testIframeWithCallback( "Check CSP (https://developer.mozilla.org/en-US/docs/Sec
 			"checkOn": true,
 			"clearCloneStyle": false,
 			"cors": true,
+			"createHTMLDocument": true,
 			"focusinBubbles": true,
 			"noCloneChecked": false,
 			"optDisabled": true,
@@ -93,6 +95,7 @@ testIframeWithCallback( "Check CSP (https://developer.mozilla.org/en-US/docs/Sec
 			"checkOn": true,
 			"clearCloneStyle": false,
 			"cors": false,
+			"createHTMLDocument": true,
 			"focusinBubbles": true,
 			"noCloneChecked": false,
 			"optDisabled": true,
@@ -109,6 +112,7 @@ testIframeWithCallback( "Check CSP (https://developer.mozilla.org/en-US/docs/Sec
 			"checkOn": true,
 			"clearCloneStyle": true,
 			"cors": true,
+			"createHTMLDocument": true,
 			"focusinBubbles": false,
 			"noCloneChecked": true,
 			"optDisabled": true,
@@ -125,6 +129,7 @@ testIframeWithCallback( "Check CSP (https://developer.mozilla.org/en-US/docs/Sec
 			"checkOn": true,
 			"clearCloneStyle": true,
 			"cors": true,
+			"createHTMLDocument": true,
 			"focusinBubbles": false,
 			"noCloneChecked": true,
 			"optDisabled": true,
@@ -141,6 +146,7 @@ testIframeWithCallback( "Check CSP (https://developer.mozilla.org/en-US/docs/Sec
 			"checkOn": true,
 			"clearCloneStyle": true,
 			"cors": true,
+			"createHTMLDocument": true,
 			"focusinBubbles": false,
 			"noCloneChecked": true,
 			"optDisabled": true,
@@ -157,6 +163,7 @@ testIframeWithCallback( "Check CSP (https://developer.mozilla.org/en-US/docs/Sec
 			"checkOn": false,
 			"clearCloneStyle": true,
 			"cors": true,
+			"createHTMLDocument": true,
 			"focusinBubbles": false,
 			"noCloneChecked": true,
 			"optDisabled": true,
@@ -173,6 +180,7 @@ testIframeWithCallback( "Check CSP (https://developer.mozilla.org/en-US/docs/Sec
 			"checkOn": false,
 			"clearCloneStyle": false,
 			"cors": true,
+			"createHTMLDocument": true,
 			"focusinBubbles": false,
 			"noCloneChecked": true,
 			"optDisabled": false,
