Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-30243

Workbox Host Plugin leaks jQuery as $ to global

XMLWordPrintable

      The Workbox - Host Plugin (1.1.27, com.atlassian.mywork.mywork-confluence-host-plugin) leaks jQuery as $ to global.

      Steps to reproduce:

      1. /sw/studio/icebat-51.1/install/install-studio.sh
      2. go to an arbitrary page (workbox resources are sourced due to the header)
      3. open console and type $, the response should be something like: 
        function ( selector, context ) {
		// The jQuery object is actually just the init constructor 'enhanced'
		return new jQuery.fn.init( selector, context, rootjQuery );
	}
      4. go to UPM (/wiki/plugins/servlet/upm/manage/all#manage)
      5. disable the Workbox - Host Plugin
      6. repeat step 2 and 3, the response now should be 
        undefined

      Please coordinate with the fix for CONFDEV-18766 before removing this, because this is currently the only reason why the issue is not hitting everyone in OnDemand land.

            [CONFSERVER-30243] Workbox Host Plugin leaks jQuery as $ to global

            fabs (Inactive) added a comment -

            pgreig just added the important information that if /plugins/servlet/myworkserviceselector.action is set to does not provide in-app notifications $ stays undefined, which basically means the leak must come from one of those resources only delivered under HostEnabledCondition. Just by flying over the js I actually now get the impression that this is not a leak at all and is rather by design. Imo it should not expose its jQuery under $, thus this should be fixed may it be a leak or not.

            fabs (Inactive) added a comment - pgreig just added the important information that if /plugins/servlet/myworkserviceselector.action is set to does not provide in-app notifications $ stays undefined, which basically means the leak must come from one of those resources only delivered under HostEnabledCondition . Just by flying over the js I actually now get the impression that this is not a leak at all and is rather by design. Imo it should not expose its jQuery under $, thus this should be fixed may it be a leak or not.

              tpiotrowski Ted Piotrowski (Inactive)
              fakraemer fabs (Inactive)
              Affected customers:
              0 This affects my team
              Watchers:
              4 Start watching this issue

                Created:
                Updated:
                Resolved: