Changeset 24252

Timestamp:

05/14/2013 05:22:58 PM (12 years ago)

Author:

ocean90

Message:

jQuery Migrate 1.2.1. see #22975.

Location:

trunk/wp-includes

Files:

• js/jquery/jquery-migrate.js (modified) (6 diffs)
• script-loader.php (modified) (1 diff)

trunk/wp-includes/js/jquery/jquery-migrate.js

@@ -1 +1 @@
 /*!
- * jQuery Migrate - v1.1.1 - 2013-02-16
+ * jQuery Migrate - v1.2.1 - 2013-05-08
  * https://github.com/jquery/jquery-migrate
  * Copyright 2005, 2013 jQuery Foundation, Inc. and other contributors; Licensed MIT
@@ -18 +18 @@
 
 // Show a message on the console so devs know we're active
-if ( !jQuery.migrateMute && window.console && console.log ) {
-    console.log("JQMIGRATE: Logging is active");
+if ( !jQuery.migrateMute && window.console && window.console.log ) {
+    window.console.log("JQMIGRATE: Logging is active");
 }
 
@@ -34 +34 @@
 
 function migrateWarn( msg) {
+    var console = window.console;
     if ( !warnedAbout[ msg ] ) {
         warnedAbout[ msg ] = true;
         jQuery.migrateWarnings.push( msg );
-        if ( window.console && console.warn && !jQuery.migrateMute ) {
+        if ( console && console.warn && !jQuery.migrateMute ) {
             console.warn( "JQMIGRATE: " + msg );
             if ( jQuery.migrateTrace && console.trace ) {
@@ -190 +191 @@
     oldInit = jQuery.fn.init,
     oldParseJSON = jQuery.parseJSON,
-    // Note this does NOT include the #9521 XSS fix from 1.7!
-    rquickExpr = /^(?:[^<]*(<[\w\W]+>)[^>]*|#([\w\-]*))$/;
+    // Note: XSS check is done below after string is trimmed
+    rquickExpr = /^([^<]*)(<[\w\W]+>)([^>]*)$/;
 
 // $(html) "looks like html" rule change
@@ -198 +199 @@
 
     if ( selector && typeof selector === "string" && !jQuery.isPlainObject( context ) &&
-            (match = rquickExpr.exec( selector )) && match[1] ) {
+            (match = rquickExpr.exec( jQuery.trim( selector ) )) && match[ 0 ] ) {
         // This is an HTML string according to the "old" rules; is it still?
         if ( selector.charAt( 0 ) !== "<" ) {
             migrateWarn("$(html) HTML strings must start with '<' character");
+        }
+        if ( match[ 3 ] ) {
+            migrateWarn("$(html) HTML text after last tag is ignored");
+        }
+        // Consistently reject any HTML-like string starting with a hash (#9521)
+        // Note that this may break jQuery 1.6.x code that otherwise would work.
+        if ( match[ 0 ].charAt( 0 ) === "#" ) {
+            migrateWarn("HTML string cannot start with a '#' character");
+            jQuery.error("JQMIGRATE: Invalid selector string (XSS)");
         }
         // Now process using loose rules; let pre-1.8 play too
@@ -209 +219 @@
         }
         if ( jQuery.parseHTML ) {
-            return oldInit.call( this, jQuery.parseHTML( jQuery.trim(selector), context, true ),
+            return oldInit.call( this, jQuery.parseHTML( match[ 2 ], context, true ),
                     context, rootjQuery );
         }

trunk/wp-includes/script-loader.php

@@ -135 +135 @@
     $scripts->add( 'jquery', false, array( 'jquery-core', 'jquery-migrate' ) );
     $scripts->add( 'jquery-core', '/wp-includes/js/jquery/jquery.js', array(), '1.9.1' );
-    $scripts->add( 'jquery-migrate', '/wp-includes/js/jquery/jquery-migrate.js', array(), '1.1.1' );
+    $scripts->add( 'jquery-migrate', '/wp-includes/js/jquery/jquery-migrate.js', array(), '1.2.1' );
 
     // full jQuery UI