-
Notifications
You must be signed in to change notification settings - Fork 20.6k
Manipulation: Respect script crossorigin attribute in DOM manipulation #4563
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Thanks for the PR, I'll have a closer look later. In the meantime, please sign our CLA, this is a requirement for us moving forwards with the PR. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There are some code styles I'm not sure about in the unit tests. I'm not the best to judge those though.
As for the patch itself, it looks good to me.
Thanks for your explaination. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is looking good! Just a few final comments.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I found some issues, please see newest comments.
@gaohuia Your PR now contains my cherry-picked PRs... Can you instead rebase your PR over current master so that it only contains your code? My commits should disappear then:
If your upstream is named differently than In the future, it's a good idea to not modify code on the This is for the future sake only, let's keep this PR as it is as you can't change the source branch when the PR is open. |
@gaohuia You can see that jQuery Slim tests failed on your PR (see the Travis link). Your unit test should be moved to Also, remember about #4563 (comment) - we still need to get the tests to succeed in IE, Edge & Safari. |
Hi @mgol I didn't see any failed tests in safari 13, can you try again? |
@gaohuia Yes, Safari 13 is still failing. Note that Travis only runs tests on Chrome & Firefox, you need to test on the other browsers manually. |
Hmm, the above test results were achieved in our PHP setup, the one that runs on our TestSwarm as well: http://swarm.jquery.org/project/jquery When I run it on the Karma setup, by running However, in Chrome & Firefox tests pass in both modes. |
I figured out the issue. Karma runs on Ultimately, we cannot rely on the URL where the tests are loaded to be
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
See some more comments.
Co-Authored-By: Michał Gołębiowski-Owczarek <m.goleb@gmail.com>
Co-Authored-By: Michał Gołębiowski-Owczarek <m.goleb@gmail.com>
Co-Authored-By: Michał Gołębiowski-Owczarek <m.goleb@gmail.com>
Co-authored-by: Michał Gołębiowski-Owczarek <m.goleb@gmail.com>
@mgol can you tell me how to run the karma tests with the real mock.php (I mean run it with php)? I added the same logic to "mock.php", but just not sure if it works fine. |
@gaohuia PHP tests are not run via Karma. To have all tests passing, you need to have Apache or nginx configured with PHP and open If this is too much, you can run a quick static PHP server in the jQuery directory:
and then open http://localhost:7001/test/?hidepassed. Note that with this basic setup some tests will fail as PHP can only handle one request at a time and some tests depend on being able to run requests in parallel. But it might be enough for your purposes. |
Thanks @mgol , i have nginx+fpm locally. the mock.php seems working good. |
Co-authored-by: Michał Gołębiowski-Owczarek <m.goleb@gmail.com>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good to me! Just one suggestion.
In my testing, the new test succeeds on BrowserStack in IE 11 in Windows 10 but not in Windows 7. I'm not sure why, maybe the Windows 7 copy is not up to date. We'll worry about that when/if we start testing on Karma in IE.
Thanks for following up with our code review remarks for this past months!
One note, @gaohuia: we're treating this as a potentially breaking change as code using the crossorigin
attribute on same-domain scripts would now switch to using the script tag injection method which is asynchronous. Because of that, for now we'll only land it on the master
branch which is the future jQuery 4.0. We can consider backporting this change to the 3.x-stable
branch if this incompatibility is resolved, maybe by only passing scriptAttrs
in jQuery._evalUrl
for cross-domain scripts? We need to be careful here, though, so at least for now it's 4.0-only.
Co-authored-by: Michał Gołębiowski-Owczarek <m.goleb@gmail.com>
Landed, thanks! |
Summary
jQuery does not respect the crossOrigin attribute on the script tag #4542
Checklist