Skip to content

jQuery ajax automatically evaluates (runs) script file #4822

Closed

Description

@AlexanderTheGr8-gr

What do you expect to happen?

When I fetch a JavaScript file with jQuery, for example with $.get(...) I do NOT expect it to run on load. *
I expect to get my data as a string (unless specified otherwise).

What actually happens?

When I fetch a JavaScript file with $.get(...) from THE SAME domain *** , then the script is auto-evaluated.
Which means the jQuery converted set in jQuery.ajaxSettings.converters['text script'] jumps into place,
and does ugly things, it actually runs the JavaScript code in the file.... while running the code of $.get(...) ...

* Since this "auto-run" functionality which is accompliced with eval** is not stated in the documentation, I suppose
no-one else expects it to happen either.

**	converters: {
		"text script": function( text ) {
			jQuery.globalEval( text );
			return text;
		}
	}

*** because hey, someone thought we should consider security and prevented auto-runing cors scripts,
and thus I can not setup an example online...
The code preventing it is this bellow, and as you can see, it already hints: "auto-execution of scripts",
which should not be part or a simple $.get(...) request...

// Prevent auto-execution of scripts when no explicit dataType was provided (See gh-2432) 
jQuery.ajaxPrefilter( function( s ) {
	if ( s.crossDomain ) {
		s.contents.script = false;
	}
} );

About conversions making sense

  • It's expected that when the file is json, I would need my data parsed, so a converter was added there,
    because when I actually come to use my data, I will need them as javascript objects.
  • But with a Javascript file, we can't have javascript in any other more useful form than string,
    unless we were to run it... And who would need javascript files to be run on fetch, since at fetch time,
    it is jQuery code, which means code execution is way before we come to the point of using -with our own code-
    that which was fetched (the javascript code)...

Link to test case

https://jsfiddle.net/a3quxb24/1/
Take a not though, as I said before the only way to stumble upon this "auto-run" js on file fetch is to have the js file
in the same domain where the $.get is executed.
And since the test code and the javascript file can not be in the same domain in my example
(To my knowledge, nor JSFiddle, Codepen or JSBin allow you to upload your own pure js file)
therefor the only way to see the bug in action, is to place a breakpoint in line 10123 in the jQuery file in JSFiddle (jquery-3.5.1.js),
turn s.crossDomain to false (in order not to disable the converted) and right after the if(s.crossDomain) is skipped
turn s.crossDomain back to true (in order for the request to be completed without errors).
And that is it! You will see how the script executes on it's own, with globalEvaluate.

Some might argue this is a feature.
But I disagree:
doing things

  • you are not requested
  • not stated in Documentation
  • and which are not absolutely logical (and therefor expected)
    is not a thing to do.
  • I want to load a javascript file as string/text. Oh, yeah, it makes perfect sense, I have to disable a converter...
  • Or, I want to load a javascript file in my document, and have it executed. Wait, don't do anything, just fetch it,
    it makes perfect sense that a javascript file fetched should be nailed to my html page, because.. you never know, you might need it right now...
    It makes no sense.

Activity

  1. AlexanderTheGr8-gr commented on Jan 3, 2021

    @AlexanderTheGr8-gr
    Author

    In case anyone else stumbles upon this problem, the solution I found was to take down the nasty converter of course (after one hour of searching the code ... ):

    jQuery.ajaxSettings.contents.script = false;
  2. added
    Discuss in MeetingReserved for Issues and PRs that anyone would like to discuss in the weekly meeting.
    on Jan 4, 2021
  3. mgol commented on Jan 4, 2021

    @mgol
    Member

    Thanks for the report. We're still discussing whether we want to change the default behavior, here's a draft PR of what that may look like: #4825.

    We've already changed the default behavior for cross-origin scripts in jQuery 3.0 (issue: gh-2432, PR: gh-2588) as that constituted a security issue.

  4. changed the title [-]JQuery ajax automatically evaluates (runs) script file[/-] [+]jQuery ajax automatically evaluates (runs) script file[/+] on Jan 11, 2021
  5. removed
    Discuss in MeetingReserved for Issues and PRs that anyone would like to discuss in the weekly meeting.
    on Jan 11, 2021
  6. added this to the 4.0.0 milestone on Jan 11, 2021
  7. timmywil commented on Jan 11, 2021

    @timmywil
    Member

    We've decided to make this change and align with the default behavior for cross-origin scripts in 4.0.

  8. added a commit that references this issue on Jan 11, 2021
    ba781e1
  9. AlexanderTheGr8-gr commented on Jan 11, 2021

    @AlexanderTheGr8-gr
    Author

    First of all, I would like to say a greatly thank you to all of you working on the library of jQuery (what would we do without it),
    because I never had the chance to say it, THANK YOU.
    Also, I want to say a thank you, for the quick response :) - I wouldn't believe it.
    And, sorry, for being an ass. I feeling stressed when I lose time and I don't know what happens :d

  10. timmywil commented on Jan 11, 2021

    @timmywil
    Member

    @alexNecroJack Thank you for the issue! Always nice to hear someone appreciates our work. I think all devs can relate to the feeling of not finishing something in the expected time, but you didn't come off as an ass to me.

  11. added a commit that references this issue on Jan 26, 2021
    fe9ebf5
  12. added a commit that references this issue on Jan 26, 2021
    025da4d
  13. locked as resolved and limited conversation to collaborators on Sep 24, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions