aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorRafael França <rafaelmfranca@gmail.com>2017-04-13 17:02:14 -0400
committerGitHub <noreply@github.com>2017-04-13 17:02:14 -0400
commita84cfe934010ba03eba27e2cb51245a1f4f656b6 (patch)
treec631ec621b17626ab2747e3c3e69a6d6d65ce071
parentfebf19d5d3d1750334acb2d3b1cd4b7da5d9637c (diff)
parentdb65f73f2e442eb87228f604d28af2548e7dd823 (diff)
downloadrails-a84cfe934010ba03eba27e2cb51245a1f4f656b6.tar.gz
rails-a84cfe934010ba03eba27e2cb51245a1f4f656b6.tar.bz2
rails-a84cfe934010ba03eba27e2cb51245a1f4f656b6.zip
Merge pull request #28748 from DmytroVasin/rails-ujs-fix-ajax-response-parsing
Fix mistake in JS response parser
-rw-r--r--actionview/app/assets/javascripts/rails-ujs/utils/ajax.coffee6
-rw-r--r--actionview/test/ujs/public/test/call-remote.js28
2 files changed, 31 insertions, 3 deletions
diff --git a/actionview/app/assets/javascripts/rails-ujs/utils/ajax.coffee b/actionview/app/assets/javascripts/rails-ujs/utils/ajax.coffee
index 6fabddf65c..26df7b9a3f 100644
--- a/actionview/app/assets/javascripts/rails-ujs/utils/ajax.coffee
+++ b/actionview/app/assets/javascripts/rails-ujs/utils/ajax.coffee
@@ -64,10 +64,10 @@ processResponse = (response, type) ->
if typeof response is 'string' and typeof type is 'string'
if type.match(/\bjson\b/)
try response = JSON.parse(response)
- else if type.match(/\bjavascript\b/)
+ else if type.match(/\b(?:java|ecma)script\b/)
script = document.createElement('script')
- script.innerHTML = response
- document.body.appendChild(script)
+ script.text = response
+ document.head.appendChild(script).parentNode.removeChild(script)
else if type.match(/\b(xml|html|svg)\b/)
parser = new DOMParser()
type = type.replace(/;.+/, '') # remove something like ';charset=utf-8'
diff --git a/actionview/test/ujs/public/test/call-remote.js b/actionview/test/ujs/public/test/call-remote.js
index dbeb8ad832..5932195363 100644
--- a/actionview/test/ujs/public/test/call-remote.js
+++ b/actionview/test/ujs/public/test/call-remote.js
@@ -100,6 +100,34 @@ asyncTest('JS code should be executed', 1, function() {
submit()
})
+asyncTest('ecmascript code should be executed', 1, function() {
+ buildForm({ method: 'post', 'data-type': 'script' })
+
+ $('form').append('<input type="text" name="content_type" value="application/ecmascript">')
+ $('form').append('<input type="text" name="content" value="ok(true, \'remote code should be run\')">')
+
+ submit()
+})
+
+asyncTest('execution of JS code does not modify current DOM', 1, function() {
+ var docLength, newDocLength
+ function getDocLength() {
+ return document.documentElement.outerHTML.length
+ }
+
+ buildForm({ method: 'post', 'data-type': 'script' })
+
+ $('form').append('<input type="text" name="content_type" value="text/javascript">')
+ $('form').append('<input type="text" name="content" value="\'remote code should be run\'">')
+
+ docLength = getDocLength()
+
+ submit(function() {
+ newDocLength = getDocLength()
+ ok(docLength === newDocLength, 'executed JS should not present in the document')
+ })
+})
+
asyncTest('XML document should be parsed', 1, function() {
buildForm({ method: 'post', 'data-type': 'html' })