$.getScript: sameDomain file:// requests fails in Chromium when using XHR

[ast@…]

When doing same-domain ​file:// XHR Chromium spits out an

XMLHttpRequest cannot load file://[...].js.
Origin null is not allowed by Access-Control-Allow-Origin.

The following patch is pullable from: ​git://git.asbjorn.biz/jquery.git getscript-fix

ajax: script: Threat sameDomain file:// requests as crossDomain

Due to file:// XHR security measures in Chromium, dynamic loading
of scripts need to use the script tag injection hack.

Tested in Chromium 6.0.472.63, Firefox 3.6.7 and Konqueror 4.4.5

Signed-off-by: Asbjørn Sloth Tønnesen <ast@mugami.com>

src/ajax/script.js

@@ -30 +30 @@
 // Bind script tag hack transport
 jQuery.ajaxTransport( "script", function(s) {
 
-        // This transport only deals with cross domain requests
-        if ( s.crossDomain ) {
+        // This transport primarily deals with cross domain requests
+        // but also sameDomain request within file:// due to
+        // http://code.google.com/p/chromium/issues/detail?id=4197 + 47416
+        var local = location.protocol === 'file:'
+        if ( s.crossDomain || local ) {
 
                 var script,
                         head = document.head || document.getElementsByTagName( "head" )[0] || document.documentElement;

Related issues in Chromiums issue tracker:

• ​http://code.google.com/p/chromium/issues/detail?id=4197
• ​http://code.google.com/p/chromium/issues/detail?id=47416

[Rick Waldron]

Duplicate of #8125.

[asbjornbiz]

This is not a duplicate of #8125, that was fixed in git two days ago, my bug report was against git, not 1.5.

Testcases based on current git HEAD and HEAD+fix: ​http://asbjorn.it/pub/bugreports/jquery/6166-testcase.tar.bz2 to be run from local ​file:// context.

BTW: The patch had a minor error which has been fixed in ​git://git.asbjorn.biz/jquery.git getscript-fix

[jaubourg]

If you wanna make sure every script requests are considered cross-domain, add the following ​prefilter:

jQuery.ajaxPrefilter( "script", function( s ) {
    s.crossDomain = true;
} );

[jitter]

#8249 is a duplicate of this ticket.