Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Replace '\uFEFF' with '!' for setInnerHTML to avoid UglifyJS bug #2249

Closed
wants to merge 1 commit into from
Closed

Conversation

syranide
Copy link
Contributor

#2247 (and mishoo/UglifyJS#556)

This is obviously quite a serious bug and even if uglifyjs fixes it, old versions will still be around to haunt people who minify themselves.

The comment should explain everything. The char is immediately removed so it should never affect rendering.

Test plan: none (should test in IE8)

cc @zpao @spicyj

@zpao
Copy link
Member

zpao commented Sep 29, 2014

This code path is only for IE8, correct?
Can you actually test in IE8 :)

@syranide
Copy link
Contributor Author

@zpao Knowingly, it exclusively targets IE8 only and it's most definitely safe (I used an ASCII-char at the start).

So as I mentioned on IRC; this PR is safe to pull.

... but I've found that createNodesFromMarkup does NOT use setInnerHTML... it uses getMarkupWrap which when combined apparently includes both of my fixes in setInnerHTML but slightly differently (due to the nature of createNodesFromMarkup). It's possible that createNodesFromMarkup shouldn't replace setInnerHTML as-is, I don't really know, but I think we should move to createNodesFromMarkup/getMarkupWrap instead of having two separate paths for largely the same purpose. Will need to look into this.

@syranide
Copy link
Contributor Author

I've opened #2273 to track the status of setInnerHTML vs createNodesFromMarkup.

@sophiebits
Copy link
Collaborator

Remind me why in #684 we didn't decide to manually insert a whitespace text node at the beginning of the markup like jQuery does in IE8? That feels cleaner to me than inserting an extra character only to remove it immediately.

@syranide
Copy link
Contributor Author

syranide commented Oct 3, 2014

@spicyj Hmm, not sure if I agree, fiddeling with textnodes seems more low-level than just prepending a char and removing it. Unless I misunderstand how jQuery does it.

@syranide
Copy link
Contributor Author

syranide commented Oct 3, 2014

PS. Also it doesn't really matter, we should be going the way of #2273 instead I think (createNodesFromMarkup uses the same trick).

@syranide
Copy link
Contributor Author

I've submitted #2340 which should be preferable.

@syranide
Copy link
Contributor Author

Since we're not rushing this, we should do it properly with #2340 instead.

@syranide syranide closed this Oct 25, 2014
@syranide syranide deleted the sihub branch October 25, 2014 11:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants