Bug Tracker

#6779 closed bug (fixed)

Opened July 09, 2010 04:18AM UTC

Closed December 27, 2010 07:44PM UTC

Last modified December 28, 2010 01:31AM UTC

Dom Manipulation fails if added text happens to match Object method

Reported by: cscott Owned by: dmethvin
Priority: high Milestone:
Component: manipulation Version: 1.4.4
Keywords: dommanip cache Cc:
Blocked by: Blocking:
Description

When you try to add the text "hasOwnProperty", for example, the

dom manipulation cache "finds" hasOwnProperty and tries to add a

*function* to the DOM. This also holds for any other methods

of Object.

The attached patch fixes the problem, by using hasOwnProperty to

ensure that the cache match isn't actually an Object method.

(We also need to ensure that hasOwnProperty isn't cacheable.)

Attachments (1)
Change History (10)

Changed July 09, 2010 04:23AM UTC by cscott comment:1

Patch also in github as: http://github.com/cscott/jquery/commit/7dbc01ae248b1abd8751fdff1ec0891b6ba1d5c6

Changed October 29, 2010 04:46PM UTC by rwaldron comment:2

owner: → cscott
priority: → undecided
status: new → pending

Please provide a reduced jsFiddle test case, thanks!

Changed November 21, 2010 03:13AM UTC by dmethvin comment:3

http://jsfiddle.net/dmethvin/SdCg8/6/ Test case

Changed November 21, 2010 03:21AM UTC by dmethvin comment:4

snover suggested we just not cache strings that have no html, that would fix the problem with a simple test for '<'.

Changed November 21, 2010 04:14AM UTC by snover comment:5

blockedby: → 5876
milestone: 1.4.3
priority: undecided → high
status: pending → open
version: 1.4.2 → 1.4.4

Beyond just not testing for strings with no HTML, I suggested to only cache strings where the first character is a <.

Changed November 21, 2010 04:14AM UTC by snover comment:6

keywords: → dommanip cache

Changed December 24, 2010 04:12AM UTC by dmethvin comment:7

owner: cscott → dmethvin
status: open → assigned

Changed December 24, 2010 04:26AM UTC by dmethvin comment:8

Fix: https://github.com/jquery/jquery/pull/146

Changed December 27, 2010 07:44PM UTC by Dave Methvin comment:9

resolution: → fixed
status: assigned → closed

Don't cache non-html strings in buildFragment to avoid possible collision with the names of Object methods like toString. Also makes the unit tests 0.5% to 8% faster. Fixes #6779.

Changeset: 5fd21fc02bda43d4e31bcf2d5b55b918a9190a7f

Changed December 28, 2010 01:31AM UTC by Dave Methvin comment:10

Don't cache non-html strings in buildFragment to avoid possible collision with the names of Object methods like toString. Also makes the unit tests 0.5% to 8% faster. Fixes #6779.

Changeset: 5fd21fc02bda43d4e31bcf2d5b55b918a9190a7f