Manipulation: execute scripts from iframe in the iframe's context

timmywil · timmywil · commit 22449eb96862 · 2015-11-09T14:14:30.000-05:00
Fixes gh-1757 Close gh-2696
diff --git a/src/core.js b/src/core.js
@@ -258,11 +258,12 @@ jQuery.extend( {
 	},
 
 	// Evaluates a script in a global context
-	globalEval: function( code ) {
-		var script = document.createElement( "script" );
+	globalEval: function( code, context ) {
+		context = context || document;
+		var script = context.createElement( "script" );
 
 		script.text = code;
-		document.head.appendChild( script ).parentNode.removeChild( script );
+		context.head.appendChild( script ).parentNode.removeChild( script );
 	},
 
 	// Convert dashed to camelCase; used by the css and data modules
diff --git a/src/manipulation.js b/src/manipulation.js
@@ -192,7 +192,7 @@ function domManip( collection, args, callback, ignored ) {
 								jQuery._evalUrl( node.src );
 							}
 						} else {
-							jQuery.globalEval( node.textContent.replace( rcleanScript, "" ) );
+							jQuery.globalEval( node.textContent.replace( rcleanScript, "" ), doc );
 						}
 					}
 				}
diff --git a/test/data/manipulation/scripts-context.html b/test/data/manipulation/scripts-context.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+	<head>
+		<meta charset=utf-8 />
+		<title>body</title>
+	</head>
+	<body>
+		<div id="qunit-fixture"></div>
+		<script src="../../jquery.js"></script>
+		<script>
+			window.parent.iframeCallback(
+				window,
+				document.body,
+				"<script>window.scriptTest = true;<\x2fscript>"
+			);
+		</script>
+	</body>
+</html>
diff --git a/test/unit/manipulation.js b/test/unit/manipulation.js
@@ -2162,6 +2162,17 @@ testIframeWithCallback(
 	}
 );
 
+testIframeWithCallback(
+	"domManip executes scripts in iframes in the iframes' context",
+	"manipulation/scripts-context.html",
+	function( frameWindow, bodyElement, html, assert ) {
+		assert.expect( 2 );
+		jQuery( bodyElement ).append( html );
+		assert.ok( !window.scriptTest, "script executed in iframe context" );
+		assert.ok( frameWindow.scriptTest, "script executed in iframe context" );
+	}
+);
+
 QUnit.test( "jQuery.clone - no exceptions for object elements #9587", function( assert ) {
 
 	assert.expect( 1 );

Original file line number	Diff line number	Diff line change
`@@ -192,7 +192,7 @@ function domManip( collection, args, callback, ignored ) {`
`192`	`192`	`jQuery._evalUrl( node.src );`
`193`	`193`	`}`
`194`	`194`	`} else {`
`195`		`- jQuery.globalEval( node.textContent.replace( rcleanScript, "" ) );`
	`195`	`+ jQuery.globalEval( node.textContent.replace( rcleanScript, "" ), doc );`
`196`	`196`	`}`
`197`	`197`	`}`
`198`	`198`	`}`