4 ms·
Oh, but we already do have that, over there: https://jquery.com/ https://jquery.com/ What's with the trend "jQ is old, old is bad! We need something that does
by Piskvorrr 8y ago
Oh, but we already do have that, over there: https://jquery.com/ https://jquery.com/
What's with the trend "jQ is old, old is bad! We need something that does the same thing, and most importantly is not named jQuery"?
- AmericanChopper 8y agoMost DOM manipulation in jQuery goes through jQuery.globalEval, which uses eval(). Meaning if you want to have a CSP, you have to allow unsafe-eval if you need to support jQuery. CSP is an incredibly useful tool, and it’s close to impossible to use it properly with jQuery.
- lmm 8y agoFirst concrete, legitimate reason I've seen all thread. Is there something fundamental about jQuery's design that forces it to use eval(), or is it possible a new version could avoids that?
- AmericanChopper 8y agoPerforming evals is a core part of the design. Take a look at the additional notes section on this documentation of the .html method. http://api.jquery.com/html/ http://api.jquery.com/html/ >By design, any jQuery constructor or method that accepts an HTML string — jQuery(), .append(), .after(), etc. — can potentially execute code This makes jQuery less safe in general, but I think the CSP restrictions this puts in place are probably a greater issue for most people. I’ve been involved in retro-fitting strict CSPs into a few projects, and more than once I’ve been thwarted by very minor use of jQuery in a couple of places.
- sbjs 8y agoIt's part of the design of the creation of new elements. But that's just one part of jQuery, and a part I would be completely okay with jQuery getting rid of.