Bug Tracker

Modify

Ticket #6842 (closed bug: fixed)

Opened 4 years ago

Last modified 2 years ago

Expando Collision Possible With noConflict()

Reported by: SlexAxton Owned by: SlexAxton
Priority: high Milestone: 1.5
Component: data Version: 1.4.3
Keywords: expando, collision, noconflict, needsreview Cc:
Blocking: Blocked by:

Description

If a page has two copies of jQuery, the jQuery expando property can still collide between these two copies even if noConflict is called. This has always been the case, but it hasn't really been feasible until some of the new V8 builds.

The expando is based off of the current millisecond:

var expando = "jQuery" + now()

This reference is available on the jQuery object, but private references exist, so it's not entirely patchable at this point, from the outside.

This would presumably be bad anywhere that unique expandos are necessary.

Test Case Here:  http://jsbin.com/ifone

Proof that it's getting too close to ignore:  http://slexaxton.com/pix/afe1.png

Change History

comment:1 follow-up: ↓ 2 Changed 4 years ago by john

Any suggestions as to an alternative? The random number generator may get us part of the way there - but I don't like having a continued random chance of a collision happening.

It might also be worthwhile to change the 'jQuery' bit to something like 'jq' + jQuery.fn.jquery to help differentiate between versions of jQuery.

comment:2 in reply to: ↑ 1 Changed 4 years ago by SlexAxton

Replying to john:

Any suggestions as to an alternative? The random number generator may get us part of the way there - but I don't like having a continued random chance of a collision happening.

It might also be worthwhile to change the 'jQuery' bit to something like 'jq' + jQuery.fn.jquery to help differentiate between versions of jQuery.

This really only matters during the use of noConflict (otherwise a lot more than this can conflict...), so perhaps changing up noConflict a bit to accept a custom expando prefix.

var my$ = jQuery.noConflict(true, 'mycoolprefix');

valid option?

comment:3 Changed 4 years ago by cowboy

You could do something like this, instead of var expando = "jQuery" + now():

var jq = window.jQuery || window.$,
  expando = "jQuery" + (
    ( jq && jq.expando && +jq.expando.replace( /\D/g, "" ) || 0 ) + 1
  );

comment:4 Changed 4 years ago by SlexAxton

I'd love for the solution to not be susceptible to collisions, even though they are even more rare than this one.

The problem with your solution, Ben, is that if someone has done noConflict(true), then a conflict is still possible. That's pretty rare, but I have run into it.

comment:5 Changed 4 years ago by SlexAxton

I have submitted a patch for this on github:  http://github.com/jquery/jquery/pull/29

comment:6 Changed 4 years ago by snover

  • Priority set to high
  • Status changed from new to open
  • Version changed from 1.4.2 to 1.4.3
  • Milestone changed from 1.4.3 to 1.5

comment:7 Changed 3 years ago by addyosmani

  • Keywords noconflict, needsreview added; noconflict removed

comment:8 Changed 3 years ago by SlexAxton

The most recent pull request after github discussion is here:

 https://github.com/jquery/jquery/pull/50

comment:9 Changed 3 years ago by SlexAxton

  • Owner set to SlexAxton
  • Status changed from open to assigned

comment:10 Changed 3 years ago by Alex Sexton

  • Status changed from assigned to closed
  • Resolution set to fixed

Changed the expando string to use a random number instead of the time, so collisions become less likely. Also added jQuery version to instantly differentiate separate versions of jQuery (a common use case for noConflict, etc, when two jQuery instances are on the page). Fixes #6842.

Changeset: faabb2c31883deabaddd5642eb5e708b5802f2b0

comment:11 Changed 3 years ago by Alex Sexton

Changed the expando string to use a random number instead of the time, so collisions become less likely. Also added jQuery version to instantly differentiate separate versions of jQuery (a common use case for noConflict, etc, when two jQuery instances are on the page). Fixes #6842.

Changeset: faabb2c31883deabaddd5642eb5e708b5802f2b0

Please follow the  bug reporting guidlines and use  jsFiddle when providing test cases and demonstrations instead of pasting the code in the ticket.

View

Add a comment

Modify Ticket

Action
as closed
Author


E-mail address and user name can be saved in the Preferences.

 
Note: See TracTickets for help on using tickets.