security/core#33 - Patch jQuery for CVE-2015-9251

See https://github.com/jquery/jquery/issues/2432#issuecomment-403761229
This will no longer be needed after upgrading to jQuery 3.x.

diff --git a/js/Common.js b/js/Common.js
index de326cda0e367aa6c7e91e8e0b2eb82e5e5f899a..93f7b1032f3574e03a46b012ca8f7a3f91df05af 100644 (file)
--- a/js/Common.js
+++ b/js/Common.js
@@ -1544,4 +1544,11 @@ if (!CRM.vars) CRM.vars = {};
     return (yiq >= 128) ? 'black' : 'white';
   };
 
+  // CVE-2015-9251 - Prevent auto-execution of scripts when no explicit dataType was provided
+  $.ajaxPrefilter(function(s) {
+    if (s.crossDomain) {
+      s.contents.script = false;
+    }
+  });
+
 })(jQuery, _);