jquery breaks when running $(window).text() while an iframe with different doamin exist on the page.

[adi-darachi]

When running $.text() on window, while there are cors iframes on the page throws an exception.

STR:

1. Open a page with that have at least one iframe from a different domain.
2. run $(window).text() .

• What do you expect to happen?

Return empty string/undefined

• What actually happens?

Throws exception (cors/security 18)

• Which browsers are affected?

(WebKit/gecko based at least)

minimal testcase -> https://jsfiddle.net/xpvt214o/127474/

• why is it happening?

a. it seems that Sizzel.getText function assumes that if the parameter sent have no .nodeType property, it must be an array, so it's start iterating the element indexes,
b. when adding iframes to the document there is a reference also on the window object
window[0...n] (n - the number of frames on the page)

so when sending the window object, it iterates also the inaccessible windows and try to access their .nodeType prop which throws an exception.

[dmethvin]

The documentation says: "Get the combined text contents of each element in the set of matched elements, including their descendants." A window object is not an element. What is the situation where some code is calling $(window).text() and expecting a result? What result does it expect?

[adi-darachi]

I'll explain, my company develop third party tool, for communication reasons, we ass iframe to the website that include our snippet.
We have a client, that created a generic event handling function for analytics purpse is assume that get the text (.text) of the execution context of the event.

So, aslong as there are no iframe with different domain on the page
$(window).text() dose not throw exception.
Other wise it will throw.

This is very undexpected from my point of view.

Essentially, we added an iframe (with different origin) to the page and the entire application failed.

[dmethvin]

But what does it mean to call $(window).text()? It's not valid, so why is your application doing it?

[adi-darachi]

It's not my application.
Our client have the following line on every event executed from jQuery:
$(this).text()
And his application works fine.
When he integrate my company code snippet, which adds an iframe from other origin, the same function break.

[adi-darachi]

I think it's very wierd that something like adding an iframe to the page can change the result of unrelated function.
It will be great to add codition, that if it has no .nodeType and it's not array, to return undefined/empty string, or to always throw exception on unhandled types

[mgol]

jQuery doesn't validate user input, it's expected that only supported method signatures will be used (according to what https://api.jquery.com returns), behavior for other inputs is undefined.

jQuery would get much larger were we to add input validation, it'd also slow down the library. If you want your input validated, consider using TypeScript which includes jQuery type definitions in the @types/jquery package.

You need to tell your client to change the invalid code.