Script tags in newly created elements (not yet added to the html page) execute when they should not #837

Closed
teeohhem opened this Issue Oct 16, 2013 · 2 comments

Comments

Projects
None yet
3 participants
@teeohhem

Script tags inside of elements that have not been added to the HTML document should not execute until they are added to the HTML document.

Example:

$('<div />').html('<script>alert("This should not render")</script>');

An alert box is shown, even though this element is not in the HTML document.

If you do this with native JS, the script does not execute:

var elem = document.createElement('div');
elem.innerHTML = "<script>alert("This should not render")</script>"

@ghost ghost assigned mislav Nov 24, 2013

@madrobby

This comment has been minimized.

Show comment
Hide comment
@madrobby

madrobby Nov 24, 2013

Owner

You are correct, this is a bug and should be fixed for jQuery API parity.

Owner

madrobby commented Nov 24, 2013

You are correct, this is a bug and should be fixed for jQuery API parity.

@mislav

This comment has been minimized.

Show comment
Hide comment
@mislav

mislav Jun 16, 2014

Collaborator

Fixed in ed63f79

Collaborator

mislav commented Jun 16, 2014

Fixed in ed63f79

@mislav mislav closed this Jun 16, 2014

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment