Core: Fire iframe script in its context, add doc param in globalEval

mgol · mgol · commit 3dedc3f2d46d · 2020-02-10T19:20:50.000+01:00
1. Support passing custom document to jQuery.globalEval; the script will be invoked in the context of this document. 2. Fire external scripts appended to iframe contents in that iframe context; this was already supported & tested for inline scripts but not for external ones. Fixes gh-4518 Closes gh-4601 (cherry picked from commit 4592595)
diff --git a/src/core.js b/src/core.js
@@ -245,9 +245,10 @@ jQuery.extend( {
 		return true;
 	},
 
-	// Evaluates a script in a global context
-	globalEval: function( code, options ) {
-		DOMEval( code, { nonce: options && options.nonce } );
+	// Evaluates a script in a provided context; falls back to the global one
+	// if not specified.
+	globalEval: function( code, options, doc ) {
+		DOMEval( code, { nonce: options && options.nonce }, doc );
 	},
 
 	each: function( obj, callback ) {
diff --git a/src/manipulation.js b/src/manipulation.js
@@ -201,7 +201,7 @@ function domManip( collection, args, callback, ignored ) {
 							if ( jQuery._evalUrl && !node.noModule ) {
 								jQuery._evalUrl( node.src, {
 									nonce: node.nonce || node.getAttribute( "nonce" )
-								} );
+								}, doc );
 							}
 						} else {
 							DOMEval( node.textContent.replace( rcleanScript, "" ), node, doc );
diff --git a/src/manipulation/_evalUrl.js b/src/manipulation/_evalUrl.js
@@ -4,7 +4,7 @@ define( [
 
 "use strict";
 
-jQuery._evalUrl = function( url, options ) {
+jQuery._evalUrl = function( url, options, doc ) {
 	return jQuery.ajax( {
 		url: url,
 
@@ -22,7 +22,7 @@ jQuery._evalUrl = function( url, options ) {
 			"text script": function() {}
 		},
 		dataFilter: function( response ) {
-			jQuery.globalEval( response, options );
+			jQuery.globalEval( response, options, doc );
 		}
 	} );
 };
diff --git a/test/data/core/globaleval-context.html b/test/data/core/globaleval-context.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+	<head>
+		<meta charset=utf-8 />
+		<title>body</title>
+	</head>
+	<body>
+		<div id="qunit-fixture"></div>
+		<script src="../../jquery.js"></script>
+		<script src="../iframeTest.js"></script>
+		<script>
+			startIframeTest();
+		</script>
+	</body>
+</html>
diff --git a/test/data/manipulation/set-global-scripttest.js b/test/data/manipulation/set-global-scripttest.js
@@ -0,0 +1,2 @@
+window.scriptTest = true;
+parent.finishTest();
diff --git a/test/data/testinit.js b/test/data/testinit.js
@@ -262,12 +262,24 @@ this.testIframe = function( title, fileName, func, wrapper ) {
 			args.unshift( assert );
 
 			setTimeout( function() {
+				var result;
+
 				this.iframeCallback = undefined;
 
-				func.apply( this, args );
-				func = function() {};
-				$iframe.remove();
-				done();
+				result = func.apply( this, args );
+
+				function finish() {
+					func = function() {};
+					$iframe.remove();
+					done();
+				}
+
+				// Wait for promises returned by `func`.
+				if ( result && result.then ) {
+					result.then( finish );
+				} else {
+					finish();
+				}
 			} );
 		};
 
diff --git a/test/unit/core.js b/test/unit/core.js
@@ -197,6 +197,19 @@ QUnit.test( "globalEval execution after script injection (#7862)", function( ass
 	assert.ok( window.strictEvalTest - now < 500, "Code executed synchronously" );
 } );
 
+testIframe(
+	"globalEval with custom document context",
+	"core/globaleval-context.html",
+	function( assert, framejQuery, frameWindow, frameDocument ) {
+		assert.expect( 2 );
+
+		jQuery.globalEval( "window.scriptTest = true;", {}, frameDocument );
+		assert.ok( !window.scriptTest, "script executed in iframe context" );
+		assert.ok( frameWindow.scriptTest, "script executed in iframe context" );
+	}
+);
+
+
 QUnit.test( "noConflict", function( assert ) {
 	assert.expect( 7 );
 
diff --git a/test/unit/manipulation.js b/test/unit/manipulation.js
@@ -2315,6 +2315,27 @@ testIframe(
 	}
 );
 
+testIframe(
+	"domManip executes external scripts in iframes in the iframes' context",
+	"manipulation/scripts-context.html",
+	function( assert, framejQuery, frameWindow, frameDocument ) {
+		assert.expect( 2 );
+
+		Globals.register( "finishTest" );
+
+		return new Promise( function( resolve ) {
+			window.finishTest = resolve;
+			jQuery( frameDocument.body ).append(
+				"<script src='" + url( "manipulation/set-global-scripttest.js" ) + "'></script>" );
+			assert.ok( !window.scriptTest, "script executed in iframe context" );
+			assert.ok( frameWindow.scriptTest, "script executed in iframe context" );
+		} );
+	},
+
+	// The AJAX module is needed for jQuery._evalUrl.
+	QUnit[ jQuery.ajax ? "test" : "skip" ]
+);
+
 QUnit.test( "jQuery.clone - no exceptions for object elements #9587", function( assert ) {
 
 	assert.expect( 1 );

Original file line number	Diff line number	Diff line change
`@@ -201,7 +201,7 @@ function domManip( collection, args, callback, ignored ) {`
`201`	`201`	`if ( jQuery._evalUrl && !node.noModule ) {`
`202`	`202`	`jQuery._evalUrl( node.src, {`
`203`	`203`	`nonce: node.nonce \|\| node.getAttribute( "nonce" )`
`204`		`- } );`
	`204`	`+ }, doc );`
`205`	`205`	`}`
`206`	`206`	`} else {`
`207`	`207`	`DOMEval( node.textContent.replace( rcleanScript, "" ), node, doc );`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+window.scriptTest = true;`
	`2`	`+parent.finishTest();`