Make sure that XHTML-style HTML is purified in .html(). Fixes #5845.

jquery · Jan 25, 2010 · 6a3d099 · 6a3d099
1 parent f06e0e5
commit 6a3d099
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 3 deletions.
diff --git a/src/manipulation.js b/src/manipulation.js
@@ -189,6 +189,8 @@ jQuery.fn.extend({
 			(jQuery.support.leadingWhitespace || !rleadingWhitespace.test( value )) &&
 			!wrapMap[ (rtagName.exec( value ) || ["", ""])[1].toLowerCase() ] ) {
 
+			value = value.replace(rxhtmlTag, fcloseTag);
+
 			try {
 				for ( var i = 0, l = this.length; i < l; i++ ) {
 					// Remove element nodes and prevent memory leaks
@@ -501,4 +503,4 @@ jQuery.extend({
 			jQuery.removeData( elem );
 		}
 	}
-});
+});
diff --git a/test/unit/manipulation.js b/test/unit/manipulation.js
@@ -793,7 +793,7 @@ test("clone() on XML nodes", function() {
 }
 
 var testHtml = function(valueObj) {
-	expect(22);
+	expect(24);
 
 	jQuery.scriptorder = 0;
 
@@ -805,6 +805,11 @@ var testHtml = function(valueObj) {
 	}
 	ok( pass, "Set HTML" );
 
+	div = jQuery("<div/>").html( valueObj('<div id="parent_1"><div id="child_1"/></div><div id="parent_2"/>') );
+
+	equals( div.children().length, 2, "Make sure two child nodes exist." );
+	equals( div.children().children().length, 1, "Make sure that a grandchild exists." );
+
 	reset();
 	// using contents will get comments regular, text, and comment nodes
 	var j = jQuery("#nonnodes").contents();
@@ -1040,4 +1045,4 @@ test("jQuery.cleanData", function() {
 
 		return div;
 	}
-});
+});