jQuery breaks with Comcast Protection Guard and any anti-keylogging protection software on IE7+

Reported by:	roger.hu@gmail.com	Owned by:	dmethvin
Priority:	low	Milestone:	1.8.2
Component:	event	Version:	1.8.0
Keywords:		Cc:
Blocked by:		Blocking:

Description

1. Install Comcast Protection Guard or any anti-key logging software that installs a DLL browser helper object that intercepts keyup events.

2. Run http://jsfiddle.net/rTxrc/13/ on IE7/IE8/IE9

3. Type a keystroke in the textarea: notice the "Object doesn't support this property or method"

The patch is actually quite small-- add handle.apply() checks inside the trigger method, since DLL onclick events appear to show up as a string 'undefined' but do not have the apply() method.

Fire handlers on the event path

for ( i = 0; i < eventPath.length && !event.isPropagationStopped(); i++ ) {

if ( handle && jQuery.acceptData( cur ) && handle.apply && handle.apply( cur, data ) === false ) {

event.preventDefault();

}

For more background, see:

http:hustoknow.blogspot.com/2012/08/the-pernicious-effects-of-comcast_29.html

Attachments (0)

Change History (6)

Changed August 31, 2012 12:05AM UTC by sindresorhus comment:1

_comment0:	Comcast should be punished for doing stuff like that... Or Microsoft for given them the ability... → 1346371531339558
component:	unfiled → event
priority:	undecided → low

Comcast should be punished for doing stuff like that... Or Microsoft for giving them the ability...

Changed August 31, 2012 07:23AM UTC by roger.hu@gmail.com comment:2

This has been a major bug affecting our users for the past few years that eluded us until now. Any application that depends on using jQuery to trigger keyup events manually will encounter this problem, since so many users are installing this anti-keylogger software when they setup Comcast.

The patch we've already implemented and has done tremendous to reduce the number of tickets reported by customers just in the past few days. Could you consider escalating and add the patch in for the next jQuery release? Many thanks!

Changed August 31, 2012 01:31PM UTC by dmethvin comment:3

milestone:	None → 1.next
status:	new → open

Well the ticket just came in 2 days ago, and we were in the midst of getting a release out the door. Your description of the problem seems reasonable so I'll mark it open. I am not sure when our next release might be, it could be a month or two.

Changed September 07, 2012 12:40PM UTC by dmethvin comment:4

milestone:	1.next → 1.8.2

Changed September 17, 2012 04:47PM UTC by dmethvin comment:5

owner:	→ dmethvin
status:	open → assigned

I'll experiment with this to see whether we can get it into 1.8.2.

Changed September 18, 2012 06:28PM UTC by Dave Methvin comment:6

resolution:	→ fixed
status:	assigned → closed

Fix #12423. Ensure we can .apply() before we try.

I can't think of an uncontrived way to unit test this, it only occurs in IE when a BHO monkeys with the links.

Changeset: e8e3e90a8620a945d2d4f6012a604d96db2bd317

Side navigation

#12423 closed bug (fixed)