jpillora / xdomain

A pure JavaScript CORS alternative
https://jpillora.com/xdomain/
3.12k stars 269 forks source link

xhook.disable always declares 'FormData' variable in window #161

Closed bowczarek closed 8 years ago

bowczarek commented 9 years ago

Hi there, recently we decided to use xDomain library in order to overcome CORS issues in the current project we're working on. The project has to be supported on IE9+ and all other evergreen browsers.

We discovered an issue under IE9. For some user scenarios we had to disable/enable (before/after) the xhook explicitly because there was a synchronous ajax call made in the legacy code. As we know IE9 does not support FormData() interface, however the xhook.disable function always declares 'FormData' variable in the window object even though it's not supported under IE9 (the value would be undefined):

xhook.disable = function() { window[XMLHTTP] = xhook[XMLHTTP]; window[FormData] = NativeFormData; };

However, in other places like instOf(obj,global) function only 'presence' of the variable is checked (not the value):

instOf = function(obj, global) { if (!(global in window)) { return false; } return obj instanceof window[global]; };

This function is called in the context of 'FormData', line 659:

if (instOf(obj.body, 'FormData')) {

that will fail under IE9 once 'FormData' is introduced/declared by the disable function.

I think that the disable function should check whether 'NativeFormData' is available before declaring 'FormData' inside of the window object, like xhook.enable does atm:

xhook.enable = function() { window[XMLHTTP] = XHookHttpRequest; if (NativeFormData) { window[FormData] = XHookFormData; } };

So the xhook.disable function would look like:

xhook.disable = function() { window[XMLHTTP] = xhook[XMLHTTP]; if (NativeFormData) { window[FormData] = NativeFormData; } };

Maybe I'm wrong, I didn't have much time to go through the sources in the details, so please forgive me my ignorance :)

jpillora commented 9 years ago

Yep, this line needs an if statement like enable