8000 fix(jqLite): prevent possible XSS due to regex-based HTML replacement by mgol · Pull Request #17028 · angular/angular.js · GitHub
[go: up one dir, main page]
Skip to content
This repository was archived by the owner on Apr 12, 2024. It is now read-only.

fix(jqLite): prevent possible XSS due to regex-based HTML replacement #17028

Merged
merged 3 commits into from
May 27, 2020
Merged

fix(jqLite): prevent possible XSS due to regex-based HTML replacement #17028

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2df43c0
fix(jqLite): prevent possible XSS due to regex-based HTML replacement
mgol May 19, 2020
05cf606
fix(jqLite): apply suggestions from code review
mgol May 26, 2020
c8b7c16
fix(jqLite): improve documentation
mgol May 26, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
fix(jqLite): apply suggestions from code review 
Co-authored-by: Michael Prentice <splaktar@gmail.com>
  • Loading branch information
@mgol @Splaktar
mgol and Splaktar authored May 26, 2020
commit 05cf60677b0cdac47ce6b860cbb7b41957a2cbba
6 changes: 3 additions & 3 deletions src/Angular.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1959,10 +1959,10 @@ function bindJQuery() {
* @description
* Restores the pre-1.8 behavior of jqLite that turns XHTML-like strings like
* `<div /><span />` to `<div></div><span></span>` instead of `<div><span></span></div>`.
* The new behavior is a security fix so if you use this method, please try to adjust
* to the change & remove the call as soon as possible.
* The new behavior is a security fix. Thus, if you need to call this function, please try to adjust
* your code for this change and remove your use of this function as soon as possible.

* Note that this only patches jqLite. If you use jQuery 3.5.0 or newer, please read
* Note that this only patches jqLite. If you use jQuery 3.5.0 or newer, please read the
* [jQuery 3.5 upgrade guide](https://jquery.com/upgrade-guide/3.5/) for more details
* about the workarounds.
*/
Expand Down
4 changes: 2 additions & 2 deletions src/jqLite.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,7 +96,7 @@
* ```js
* angular.UNSAFE_restoreLegacyJqLiteXHTMLReplacement();
* ```
* Note that this only patches jqLite. If you use jQuery 3.5.0 or newer, please read
* Note that this only patches jqLite. If you use jQuery 3.5.0 or newer, please read the
* [jQuery 3.5 upgrade guide](https://jquery.com/upgrade-guide/3.5/) for more details
* about the workarounds.
*
Expand Down Expand Up @@ -196,7 +196,7 @@ wrapMap.th = wrapMap.td;

// Support: IE <10 only
// IE 9 requires an option wrapper & it needs to have the whole table structure
// set up up front; assigning `"<td></td>"` to `tr.innerHTML` doesn't work, etc.
// set up in advance; assigning `"<td></td>"` to `tr.innerHTML` doesn't work, etc.
var wrapMapIE9 = {
option: [1, '<select multiple="multiple">', '</select>'],
_default: [0, '', '']
Expand Down
0