From d44ccb582b3d091802e430c917b3d8397d1f7009 Mon Sep 17 00:00:00 2001
From: guy <guy@finereport.com>
Date: Mon, 21 Dec 2020 16:05:59 +0800
Subject: [PATCH] =?UTF-8?q?jqueryXss=E6=BC=8F=E6=B4=9Ehttps://cloud.tencen?=
 =?UTF-8?q?t.com/developer/article/1638163?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/core/platform/web/jquery/_jquery.js | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/src/core/platform/web/jquery/_jquery.js b/src/core/platform/web/jquery/_jquery.js
index 590fda029..8b34748ae 100644
--- a/src/core/platform/web/jquery/_jquery.js
+++ b/src/core/platform/web/jquery/_jquery.js
@@ -4495,6 +4495,12 @@
 		div.innerHTML = "<textarea>x</textarea>";
 		support.noCloneChecked = !!div.cloneNode( true ).lastChild.defaultValue;
 
+		// Support: IE <=9 only
+		// IE <=9 replaces <option> tags with their contents when inserted outside of
+		// the select element.
+		div.innerHTML = "<option></option>";
+		support.option = !!div.lastChild;
+
 		// #11217 - WebKit loses check when the name is after the checked attribute
 		fragment.appendChild( div );
 
@@ -4525,7 +4531,7 @@
 
 // We have to close these tags to support XHTML (#13200)
 	var wrapMap = {
-		option: [ 1, "<select multiple='multiple'>", "</select>" ],
+		// option: [ 1, "<select multiple='multiple'>", "</select>" ],
 		legend: [ 1, "<fieldset>", "</fieldset>" ],
 		area: [ 1, "<map>", "</map>" ],
 
@@ -4541,12 +4547,16 @@
 		_default: support.htmlSerialize ? [ 0, "", "" ] : [ 1, "X<div>", "</div>" ]
 	};
 
-// Support: IE8-IE9
-	wrapMap.optgroup = wrapMap.option;
+// // Support: IE8-IE9
+// 	wrapMap.optgroup = wrapMap.option;
 
 	wrapMap.tbody = wrapMap.tfoot = wrapMap.colgroup = wrapMap.caption = wrapMap.thead;
 	wrapMap.th = wrapMap.td;
 
+	// Support: IE <=9 only
+	if ( !support.option ) {
+		wrapMap.optgroup = wrapMap.option = [ 1, "<select multiple='multiple'>", "</select>" ];
+	}
 
 	function getAll( context, tag ) {
 		var elems, elem,