Merge pull request #1582 from navnitan-7/fix/cve-2015-9251-jquery-ajax

Potential Vulnerability in Cloned Code
This commit is contained in:
Jokob @NetAlertX
2026-04-02 07:42:51 +11:00
committed by GitHub

View File

@@ -9059,6 +9059,11 @@ function ajaxConvert( s, response, jqXHR, isSuccess ) {
// Convert response if prev dataType is non-auto and differs from current
} else if ( prev !== "*" && prev !== current ) {
// Mitigate possible XSS vulnerability (gh-2432)
if ( s.crossDomain && current === "script" ) {
continue;
}
// Seek a direct converter
conv = converters[ prev + " " + current ] || converters[ "* " + current ];