|
@@ -0,0 +1,112 @@
|
|
|
+/**
|
|
|
+ * For jQuery versions less than 3.4.0, this replaces the jQuery.extend
|
|
|
+ * function with the one from jQuery 3.4.0, slightly modified (documented
|
|
|
+ * below) to be compatible with older jQuery versions and browsers.
|
|
|
+ *
|
|
|
+ * This provides the Object.prototype pollution vulnerability fix to Drupal
|
|
|
+ * installations running older jQuery versions, including the versions shipped
|
|
|
+ * with Drupal core and https://www.drupal.org/project/jquery_update.
|
|
|
+ *
|
|
|
+ * @see https://github.com/jquery/jquery/pull/4333
|
|
|
+ */
|
|
|
+
|
|
|
+(function (jQuery) {
|
|
|
+
|
|
|
+// Do not override jQuery.extend() if the jQuery version is already >=3.4.0.
|
|
|
+var versionParts = jQuery.fn.jquery.split('.');
|
|
|
+var majorVersion = parseInt(versionParts[0]);
|
|
|
+var minorVersion = parseInt(versionParts[1]);
|
|
|
+var patchVersion = parseInt(versionParts[2]);
|
|
|
+var isPreReleaseVersion = (patchVersion.toString() !== versionParts[2]);
|
|
|
+if (
|
|
|
+ (majorVersion > 3) ||
|
|
|
+ (majorVersion === 3 && minorVersion > 4) ||
|
|
|
+ (majorVersion === 3 && minorVersion === 4 && patchVersion > 0) ||
|
|
|
+ (majorVersion === 3 && minorVersion === 4 && patchVersion === 0 && !isPreReleaseVersion)
|
|
|
+) {
|
|
|
+ return;
|
|
|
+}
|
|
|
+
|
|
|
+/**
|
|
|
+ * This is almost verbatim copied from jQuery 3.4.0.
|
|
|
+ *
|
|
|
+ * Only two minor changes have been made:
|
|
|
+ * - The call to isFunction() is changed to jQuery.isFunction().
|
|
|
+ * - The two calls to Array.isArray() is changed to jQuery.isArray().
|
|
|
+ *
|
|
|
+ * The above two changes ensure compatibility with all older jQuery versions
|
|
|
+ * (1.4.4 - 3.3.1) and older browser versions (e.g., IE8).
|
|
|
+ */
|
|
|
+jQuery.extend = jQuery.fn.extend = function() {
|
|
|
+ var options, name, src, copy, copyIsArray, clone,
|
|
|
+ target = arguments[ 0 ] || {},
|
|
|
+ i = 1,
|
|
|
+ length = arguments.length,
|
|
|
+ deep = false;
|
|
|
+
|
|
|
+ // Handle a deep copy situation
|
|
|
+ if ( typeof target === "boolean" ) {
|
|
|
+ deep = target;
|
|
|
+
|
|
|
+ // Skip the boolean and the target
|
|
|
+ target = arguments[ i ] || {};
|
|
|
+ i++;
|
|
|
+ }
|
|
|
+
|
|
|
+ // Handle case when target is a string or something (possible in deep copy)
|
|
|
+ if ( typeof target !== "object" && !jQuery.isFunction( target ) ) {
|
|
|
+ target = {};
|
|
|
+ }
|
|
|
+
|
|
|
+ // Extend jQuery itself if only one argument is passed
|
|
|
+ if ( i === length ) {
|
|
|
+ target = this;
|
|
|
+ i--;
|
|
|
+ }
|
|
|
+
|
|
|
+ for ( ; i < length; i++ ) {
|
|
|
+
|
|
|
+ // Only deal with non-null/undefined values
|
|
|
+ if ( ( options = arguments[ i ] ) != null ) {
|
|
|
+
|
|
|
+ // Extend the base object
|
|
|
+ for ( name in options ) {
|
|
|
+ copy = options[ name ];
|
|
|
+
|
|
|
+ // Prevent Object.prototype pollution
|
|
|
+ // Prevent never-ending loop
|
|
|
+ if ( name === "__proto__" || target === copy ) {
|
|
|
+ continue;
|
|
|
+ }
|
|
|
+
|
|
|
+ // Recurse if we're merging plain objects or arrays
|
|
|
+ if ( deep && copy && ( jQuery.isPlainObject( copy ) ||
|
|
|
+ ( copyIsArray = jQuery.isArray( copy ) ) ) ) {
|
|
|
+ src = target[ name ];
|
|
|
+
|
|
|
+ // Ensure proper type for the source value
|
|
|
+ if ( copyIsArray && !jQuery.isArray( src ) ) {
|
|
|
+ clone = [];
|
|
|
+ } else if ( !copyIsArray && !jQuery.isPlainObject( src ) ) {
|
|
|
+ clone = {};
|
|
|
+ } else {
|
|
|
+ clone = src;
|
|
|
+ }
|
|
|
+ copyIsArray = false;
|
|
|
+
|
|
|
+ // Never move original objects, clone them
|
|
|
+ target[ name ] = jQuery.extend( deep, clone, copy );
|
|
|
+
|
|
|
+ // Don't bring in undefined values
|
|
|
+ } else if ( copy !== undefined ) {
|
|
|
+ target[ name ] = copy;
|
|
|
+ }
|
|
|
+ }
|
|
|
+ }
|
|
|
+ }
|
|
|
+
|
|
|
+ // Return the modified object
|
|
|
+ return target;
|
|
|
+};
|
|
|
+
|
|
|
+})(jQuery);
|