locked
jQuery breaks my app in Metro apps for RC!

    Question

  • It looks like the new Security specs have disabled injecting html into the DOM  ("Developing secure apps") while understandable from a tight security perspective it also immidately breaks jQuery right out of the gate.. line 1379 of jQuery 1.7.2 causes apps to crash before they start

    div.innerHTML = "   <link/><table></table><a href='/a' style='top:1px;float:left;opacity:.55;'>a</a><input type='checkbox'/>";

    Also, I am sure this is going to kill support for great MVVM tools like knockout.js and I have another project that relys heavily on D3.js that I am now very worried about..

    Is there a way to turn off this new "security" feature.. after all as advanced HTML5 app developers we have already dealt with these risks for quite a while and it seems a bit like MS going a bit overboard.. Not to mention causing countless great JS libraries to move from the "works great" to "must port" category...

    Any insight would be wonderful here as I have 3 apps that are all now dead in the water with who knows how much work they need due to this new nany-state like DOM security principal.

    Josh


    Monday, June 04, 2012 8:55 PM

Answers

  • I ran into this issue, and noticed its just a warning error, can be safely ignored. But if you are still concerned about it, you might simply add "toStaticHTML()" around those lines. The line can be easily found in jqeury source (by searching for checkbox). Just wrap that line inside toStaticHTML.

    I personally just ignored it. It did not affect the app in any way.

    ps: I am using backbonejs so it looks like even the 3rd party libs don't have any problem with this warning/message.

    Tuesday, June 05, 2012 9:14 PM

All replies

  • Josh,

    Do you have any idea how to fix, or by pass this error?


    Regards,

    Bruno Bourbon

    Tuesday, June 05, 2012 1:47 PM
  • Do you have an example that reproduces the issue? I'm able to use the "insertAfter" function just fine. I used the example from the W3C School (http://www.w3schools.com/jquery/html_insertafter.asp), and it runs just fine in the RC. I tried both jquery-1.7.2-min.js and jquery-1.7.2.js; both work fine for me.
    Tuesday, June 05, 2012 3:29 PM
  • Josh,

    jQuery is used in other apps and works fine.  Lets see some sample code.  Can you post something on skydrive for us to look at?

    -Jeff


    Jeff Sanders (MSFT)

    Tuesday, June 05, 2012 5:47 PM
    Moderator
  • My examples are in project right now.. I'll have to make a sample project.. I'll post something here in a day or two..


    Tuesday, June 05, 2012 6:00 PM
  • Thanks Josh!

    Jeff Sanders (MSFT)

    Tuesday, June 05, 2012 6:15 PM
    Moderator
  • I ran into this issue, and noticed its just a warning error, can be safely ignored. But if you are still concerned about it, you might simply add "toStaticHTML()" around those lines. The line can be easily found in jqeury source (by searching for checkbox). Just wrap that line inside toStaticHTML.

    I personally just ignored it. It did not affect the app in any way.

    ps: I am using backbonejs so it looks like even the 3rd party libs don't have any problem with this warning/message.

    Tuesday, June 05, 2012 9:14 PM