Bug Tracker

Modify

Ticket #6558 (closed bug: invalid)

Opened 3 years ago

Last modified 11 months ago

appendTo allows script tags to leak into the DOM

Reported by: arn_o Owned by:
Priority: low Milestone: 1.next
Component: manipulation Version: 1.4.4
Keywords: append appendto head script Cc:
Blocking: Blocked by:

Description

In firefox 3.6.3 when I use

$('head').append('<script type="text/javascript" src="/src.js"></script>');

The script is loaded correctly but I can't retrieve this freshly added <script> tag in the list when I ask for it:

jsList = $("head > script[src][type='text/javascript']");

However I can retrieve it if I add it this way:

$('<script type="text/javascript" src="/src.js"></script>').appendTo('head');

or this way:

var e = document.createElement("script"); e.src = '/src.js'; e.type="text/javascript"; head.appendChild(e);

Shouldn't those three ways of adding a <script> tag to the <head> behave the same way ?

Change History

comment:1 Changed 3 years ago by snover

  • Milestone 1.4.3 deleted

Resetting milestone to future.

comment:2 Changed 3 years ago by snover

  • Priority set to low
  • Status changed from new to open
  • Summary changed from different behaviour between $('head').append('<script ...') and $('<script...').appendTo('head') to appendTo allows script tags to leak into the DOM
  • Version changed from 1.4.2 to 1.4.4
  • Milestone set to 1.4.5

appendTo should not be appending the script tag.

comment:3 Changed 23 months ago by john

#7626 is a duplicate of this ticket.

comment:4 Changed 23 months ago by john

This has to do with how jQuery executes script tags - we remove script tags that we execute in order to not run them again, we need to the same here for the $("script").appendTo() case. Confirmed in triage.

comment:5 Changed 16 months ago by gibson042

I cannot reproduce this with 1.7.1 or jquery-git. Was it fixed somewhere along the line?

comment:6 Changed 11 months ago by dmethvin

  • Status changed from open to closed
  • Resolution set to invalid

It may have been fixed but since there have been no recent reports/confirmations and there wasn't a test case I'll mark it invalid.

Please follow the  bug reporting guidlines and use  jsFiddle when providing test cases and demonstrations instead of pasting the code in the ticket.

View

Add a comment

Modify Ticket

Action
as closed
Author


E-mail address and user name can be saved in the Preferences.

 
Note: See TracTickets for help on using tickets.