New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

data-URI scripts insertion #1887

Closed
rhyzx opened this Issue Nov 27, 2014 · 6 comments

Comments

Projects
None yet
4 participants
@rhyzx
Contributor

rhyzx commented Nov 27, 2014

var s = document.createElement('script')
s.src = 'data:,console.log(1)'

document.body.appendChild(s)
// output 1

but if insert this script by jQuery: $('body').append(s), it will be get an error.


this is due to jQuery execute script by ajax of script[src],
and jQuery will append extra query params _=xxxx to prevent script cache by default.
https://github.com/jquery/jquery/blob/2.1.1/src/manipulation/_evalUrl.js#L9

fix this is simple, just set cache=true… may i pull a PR for this?


by the way, anyone knows why jQuery set async=false for inserted scripts?
this is inconsistent with browser's default behavior

@markelog

This comment has been minimized.

Show comment
Hide comment
@markelog

markelog Nov 27, 2014

Member

I guess it logical to support this kind of stuff and seems fix for it is pretty easy. So i'd say yes, PR would be cool, don't forget to read the contribution guide - http://contribute.jquery.org/.

anyone knows why jQuery set async=false for inserted scripts?

Wonder why we deviate from the spec here too, i remember we had a discussion about this, but don't remember specifics.

/cc @gibson042 ?

Member

markelog commented Nov 27, 2014

I guess it logical to support this kind of stuff and seems fix for it is pretty easy. So i'd say yes, PR would be cool, don't forget to read the contribution guide - http://contribute.jquery.org/.

anyone knows why jQuery set async=false for inserted scripts?

Wonder why we deviate from the spec here too, i remember we had a discussion about this, but don't remember specifics.

/cc @gibson042 ?

@dmethvin

This comment has been minimized.

Show comment
Hide comment
@dmethvin

dmethvin Nov 27, 2014

Member

The problem was that a long time ago we used XHR and did this synchronously, and people started to depend on this by creating HTML-script-tag hybrids that expected the script to be run right after the HTML was injected into the document and be able to do something with it. Our change to full-time script tag when extracting the scripts from an HTML fragment still allows this but doesn't guarantee synchronicity, which is fine with me.

Member

dmethvin commented Nov 27, 2014

The problem was that a long time ago we used XHR and did this synchronously, and people started to depend on this by creating HTML-script-tag hybrids that expected the script to be run right after the HTML was injected into the document and be able to do something with it. Our change to full-time script tag when extracting the scripts from an HTML fragment still allows this but doesn't guarantee synchronicity, which is fine with me.

@markelog

This comment has been minimized.

Show comment
Hide comment
@markelog

markelog Nov 27, 2014

Member

@dmethvin it seems we could change that now and conform with DOM behaviour - 3.0 and all that.

But do we want to? Any concerns with perspective logic?

Member

markelog commented Nov 27, 2014

@dmethvin it seems we could change that now and conform with DOM behaviour - 3.0 and all that.

But do we want to? Any concerns with perspective logic?

@rhyzx

This comment has been minimized.

Show comment
Hide comment
@rhyzx

rhyzx Nov 28, 2014

Contributor

ok, for historical reasons…
thanks @dmethvin

Contributor

rhyzx commented Nov 28, 2014

ok, for historical reasons…
thanks @dmethvin

rhyzx added a commit to rhyzx/jquery that referenced this issue Nov 29, 2014

rhyzx added a commit to rhyzx/jquery that referenced this issue Dec 3, 2014

@markelog markelog closed this in 15f4dec Dec 3, 2014

@dmethvin dmethvin added this to the 3.0.0 milestone Dec 8, 2014

@Manoj-Roy

This comment has been minimized.

Show comment
Hide comment
@Manoj-Roy

Manoj-Roy Dec 3, 2015

var s = document.createElement('script');
var minS = s.src = 'data:console.log(1)';

document.body.appendChild(s);
// output 1

GET data:console.log(1) net::ERR_INVALID_URL

Manoj-Roy commented Dec 3, 2015

var s = document.createElement('script');
var minS = s.src = 'data:console.log(1)';

document.body.appendChild(s);
// output 1

GET data:console.log(1) net::ERR_INVALID_URL

@Manoj-Roy

This comment has been minimized.

Show comment
Hide comment
@Manoj-Roy

Manoj-Roy Dec 3, 2015

or u can try it :

var s = document.createElement('script');
s.src = 'https://code.jquery.com/jquery-2.1.4.min.js';

document.body.appendChild(s);

Manoj-Roy commented Dec 3, 2015

or u can try it :

var s = document.createElement('script');
s.src = 'https://code.jquery.com/jquery-2.1.4.min.js';

document.body.appendChild(s);

@dmethvin dmethvin changed the title from data-URI scripts insertion not supported to data-URI scripts insertion Mar 15, 2016

@lock lock bot locked as resolved and limited conversation to collaborators Jun 18, 2018

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.