Skip to content

Do not execute scripts for unsuccessful http responses #4250 #4379

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
skrobinson wants to merge 13 commits into from
Closed

Do not execute scripts for unsuccessful http responses #4250 #4379

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
692e2bb
Add wip- branches to Travis builds
skrobinson Apr 26, 2019
8d2ee2e
Ajax: Use noop converter for unsuccessful HTTP responses
skrobinson Apr 25, 2019
9e6e84c
Improve test message
skrobinson Apr 29, 2019
f2c7619
Fix error message test
skrobinson Apr 29, 2019
21803c6
Revert "Add wip- branches to Travis builds"
skrobinson May 7, 2019
dd3f7c8
Limit noop converter to script type
skrobinson May 7, 2019
7353e4a
Improve conditional for script type and unit tests
skrobinson Jun 12, 2019
769af1b
Simplify request function parameters
skrobinson Jul 23, 2019
71109f6
Change URL for missing script file
skrobinson Jul 23, 2019
49c414e
Expand tests to include script and non-script mock server responses
skrobinson Aug 29, 2019
301e1b3
Fix whitespace in mock.php: spaces to tabs
skrobinson Sep 6, 2019
dce55ba
Use camelCase with fail converters variable name
skrobinson Sep 6, 2019
db906f0
Rename script type parameter
skrobinson Sep 6, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions src/ajax.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -748,6 +748,11 @@ jQuery.extend( {
response = ajaxHandleResponses( s, jqXHR, responses );
}

// Use a noop converter for missing script
if ( !isSuccess && jQuery.inArray( "script", s.dataTypes ) > -1 ) {
s.converters[ "text script" ] = function() {};
}

// Convert no matter what (that way responseXXX fields are always set)
response = ajaxConvert( s, response, jqXHR, isSuccess );

Expand Down
13 changes: 13 additions & 0 deletions test/data/mock.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -216,6 +216,19 @@ protected function cspClean( $req ) {
unlink( $this->cspFile );
}

protected function errorWithScript( $req ) {
header( 'HTTP/1.0 404 Not Found' );
if ( isset( $req->query['withScriptContentType'] ) ) {
header( 'Content-Type: application/javascript' );
}
if ( isset( $req->query['callback'] ) ) {
$callback = $req->query['callback'];
echo $callback . '( {"status": 404, "msg": "Not Found"} )';
} else {
echo 'QUnit.assert.ok( false, "Mock return erroneously executed" );';
}
}

public function __construct() {
$this->cspFile = __DIR__ . '/support/csp.log';
}
Expand Down
12 changes: 12 additions & 0 deletions test/middleware-mockserver.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -226,6 +226,18 @@ var mocks = {
cspLog = "";
resp.writeHead( 200 );
resp.end();
},
errorWithScript: function( req, resp ) {
if ( req.query.withScriptContentType ) {
resp.writeHead( 404, { "Content-Type": "application/javascript" } );
} else {
resp.writeHead( 404 );
}
if ( req.query.callback ) {
resp.end( req.query.callback + "( {\"status\": 404, \"msg\": \"Not Found\"} )" );
} else {
resp.end( "QUnit.assert.ok( false, \"Mock return erroneously executed\" );" );
}
}
};
var handlers = {
Expand Down
115 changes: 115 additions & 0 deletions test/unit/ajax.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -806,6 +806,121 @@ QUnit.module( "ajax", {
};
} );

ajaxTest( "jQuery.ajax() - do not execute scripts from unsuccessful responses (gh-4250)", 11, function( assert ) {
var globalEval = jQuery.globalEval;

var failConverters = {
"text script": function() {
assert.ok( false, "No converter for unsuccessful response" );
}
};

function request( title, options ) {
var testMsg = title + ": expected file missing status";
return jQuery.extend( {
beforeSend: function() {
jQuery.globalEval = function() {
assert.ok( false, "Should not eval" );
};
},
complete: function() {
jQuery.globalEval = globalEval;
},
// error is the significant assertion
error: function( xhr ) {
assert.strictEqual( xhr.status, 404, testMsg );
},
success: function() {
assert.ok( false, "Unanticipated success" );
}
}, options );
}

return [
request(
"HTML reply",
{
url: url( "404.txt" )
}
),
request(
"HTML reply with dataType",
{
dataType: "script",
url: url( "404.txt" )
}
),
request(
"script reply",
{
url: url( "mock.php?action=errorWithScript&withScriptContentType" )
}
),
request(
"non-script reply",
{
url: url( "mock.php?action=errorWithScript" )
}
),
request(
"script reply with dataType",
{
dataType: "script",
url: url( "mock.php?action=errorWithScript&withScriptContentType" )
}
),
request(
"non-script reply with dataType",
{
dataType: "script",
url: url( "mock.php?action=errorWithScript" )
}
),
request(
"script reply with converter",
{
converters: failConverters,
url: url( "mock.php?action=errorWithScript&withScriptContentType" )
}
),
request(
"non-script reply with converter",
{
converters: failConverters,
url: url( "mock.php?action=errorWithScript" )
}
),
request(
"script reply with converter and dataType",
{
converters: failConverters,
dataType: "script",
url: url( "mock.php?action=errorWithScript&withScriptContentType" )
}
),
request(
"non-script reply with converter and dataType",
{
converters: failConverters,
dataType: "script",
url: url( "mock.php?action=errorWithScript" )
}
),
request(
"JSONP reply with dataType",
{
dataType: "jsonp",
url: url( "mock.php?action=errorWithScript" ),
beforeSend: function() {
jQuery.globalEval = function( response ) {
assert.ok( /"status": 404, "msg": "Not Found"/.test( response ), "Error object returned" );
};
}
}
)
];
} );

ajaxTest( "jQuery.ajax() - synchronous request", 1, function( assert ) {
return {
url: url( "json_obj.js" ),
Expand Down