Bug Tracker

Ticket #1734 (new bug)

Opened 1 year ago

Last modified 1 month ago

html(val) in IE6/7: inserted content has allways security zone "internet"

Reported by: daniel Assigned to: anonymous
Type: bug Priority: major
Milestone: 1.2.2 Component: core
Version: 1.2.1 Keywords:
Cc: daniel.wiesner@itc-halle.de Needs: Review

Description

When javascript is disabled for the zone "internet" and the following page is started from a zone with javascript enabled (eg. local filesystem or from a domain marked as trusted site) the first links produced by html(val) dosn't work. The second works.

This is a critial bug. In some intranets it isn't possible to enable javascript for the zone "internet".

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml">

<head id="Head1">

<meta name="generator" content="HTML Tidy, see www.w3.org" /> <title>Unbenannte Seite</title>

<script type="text/javascript" src="js/jquery-1.2.1.js"></script> <script>

$(document).ready(function(){

$("#test1").html("<a onclick=\"alert('html(val)')\" href=\"#\">html(val)</a>"); document.getElementById("test2").innerHTML="<a onclick=\"alert('innerHTML')\" href=\"#\">innerHTML</a>";

});

</script>

</head> <body>

<div id="test1">

</div> <div id="test2"> </div>

</body>

</html>

Attachments

Change History

Changed 1 year ago by davidserduke

That is very odd. Unfortunately I have no idea how IE decided it was invalid. Does someone else know more about this problem?

Changed 1 year ago by davidserduke

  • priority changed from critical to major

Changed 1 month ago by dmethvin

It's the HTML-to-DOM translation in jQuery.clean. A new div is created using context.createElement("div") and the incoming HTML converted by assigning to div.innerHTML. Since the div isn't attached to any document, IE seems to assume the worst and uses a restricted security zone. If you append the div to the document body before using innerHTML and remove it afterwards, the script is processed in the right zone: 

// Go to html and back, then peel off extra wrappers
context.getElementsByTagName("body")[0].appendChild(div);  //hack
div.innerHTML = wrap[1] + elem + wrap[2];
context.getElementsByTagName("body")[0].removeChild(div);  //hack

This would need to be tightened up and tested; I'd hate to make jQuery.clean any slower. A workaround for the reporter would be to put all the scripts in the intranet-zone document and attach event handlers there rather than injecting them via html strings, which is the preferred way to do it anyway.

Note: See TracTickets for help on using tickets.