Skip to content

Conversation

@mgol
Copy link
Member

@mgol mgol commented Jan 4, 2021

Ajax: Don't auto-execute scripts unless dataType provided

PR gh-2588 made jQuery stop auto-execute cross-domain scripts unless
dataType: "script" was explicitly provided; this change landed in jQuery
3.0.0. This change extends that logic same-domain scripts as well.

After this change, to request a script under a provided URL to be evaluated,
you need to provide dataType: "script in jQuery.ajax options or to use
jQuery.getScript.

Fixes gh-4822
Ref gh-2432
Ref gh-2588

-28 bytes

Checklist

@mgol mgol added Ajax Needs review Behavior Change Discuss in Meeting Reserved for Issues and PRs that anyone would like to discuss in the weekly meeting. labels Jan 4, 2021
@mgol mgol added this to the 4.0.0 milestone Jan 4, 2021
@mgol mgol marked this pull request as ready for review January 11, 2021 17:16
@mgol mgol force-pushed the ajax-script-no-auto-execute-gh-4822 branch from b7445b2 to ba781e1 Compare January 11, 2021 17:21
@mgol mgol removed the Discuss in Meeting Reserved for Issues and PRs that anyone would like to discuss in the weekly meeting. label Jan 11, 2021
Copy link
Member

@timmywil timmywil left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@mgol mgol removed the Needs review label Jan 25, 2021
PR jquerygh-2588 made jQuery stop auto-execute cross-domain scripts unless
`dataType: "script"` was explicitly provided; this change landed in jQuery
3.0.0. This change extends that logic same-domain scripts as well.

After this change, to request a script under a provided URL to be evaluated,
you need to provide `dataType: "script` in `jQuery.ajax` options or to use
`jQuery.getScript`.

Fixes jquerygh-4822
Ref jquerygh-2432
Ref jquerygh-2588
@mgol mgol force-pushed the ajax-script-no-auto-execute-gh-4822 branch from ba781e1 to fe9ebf5 Compare January 26, 2021 14:54
@mgol mgol merged commit 025da4d into jquery:master Jan 26, 2021
@mgol mgol deleted the ajax-script-no-auto-execute-gh-4822 branch January 26, 2021 14:58
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Sep 24, 2025
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Development

Successfully merging this pull request may close these issues.

jQuery ajax automatically evaluates (runs) script file

2 participants