Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

jQuery does not respect the crossOrigin attribute on the script tag #4542

Closed
gaohuia opened this issue Nov 15, 2019 · 3 comments
Closed

jQuery does not respect the crossOrigin attribute on the script tag #4542

gaohuia opened this issue Nov 15, 2019 · 3 comments
Labels
Behavior Change Has Pull Request Manipulation
Milestone
4.0.0

Comments

@gaohuia
Copy link
Contributor

gaohuia commented Nov 15, 2019 •
edited

Don't know if it is a new issue for you, I just met it in our site.

Description

Just look at the following HTML code. There are two script tags in the page, one is statically written and the other is added by jQuery. And they are almost the same except a small difference on the src.

Steps:

  1. Put this page on a html server, and get a link to that page.
  2. Open your browser, I used chrome v78.
  3. New tab and press F12 to open the dev tool.
  4. Change to the Network tab.
  5. Open the link you got in 1st step.
  6. Observe the network.

Expect: Both jquery-3.4.1.min.js && jquery-3.4.1.min.js?cors should be issued with the http header "Origin"
Result: Only jquery-3.4.1.min.js is issued with the "Origin" header, the other one is not.

When this issue happened, the browser caches the response of jquery-3.4.1.min.js?cors which has no CORS headers. And if other pages use this script with SRI, it will be blocked. Because it matches the cache but the cache does not contain a CORS header like "Access-Control-Allow-Origin".

<!doctype html>
<html lang="en">
<head>
    <script src="https://code.jquery.com/jquery-3.4.1.min.js" crossorigin="anonymous"></script>
    <script>
        $(function(){
            $("#container").html('<script src="//code.jquery.com/jquery-3.4.1.min.js?cors" crossorigin="anonymous" ><\/script>');
            alert('done');
        });
    </script>

</head>
<body>
    <div id="container"></div>
</body>
</html>
@mgol
Copy link
Member

mgol commented Dec 9, 2019

It seems we might just need to add support for the crossOrigin property on script elements to src/core/DOMEval.js#L3-L8. If possible, we should also write an iframe test that ensures this fixes the issue you mention.

Would you like to try to submit a PR for that?

@mgol mgol added this to the 3.5.0 milestone Dec 9, 2019
@gaohuia
Copy link
Contributor Author

gaohuia commented Dec 10, 2019

It seems to be related with the transport of "script".
I'll try to make a PR later.

@gaohuia gaohuia mentioned this issue Dec 10, 2019
Merged
4 tasks
@mgol mgol modified the milestones: 3.5.0, 3.6.0 Mar 16, 2020
@timmywil timmywil modified the milestones: 3.6.0, 4.0.0 Sep 14, 2020
@timmywil
Copy link
Member

Moving to 4.0 as this is a breaking change.

@mgol mgol closed this as completed in 15ae361 Sep 22, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Behavior Change Has Pull Request Manipulation
Milestone
4.0.0
Development

No branches or pull requests
3 participants
@timmywil @mgol @gaohuia