X-Git-Url: http://git.asbjorn.biz/?p=jquery.git;a=blobdiff_plain;f=src%2Fsupport.js;h=4807ce27eb23c3ca3aca36a9c5612a6f3fbb6c44;hp=f502811ae8d8b78d0424caa4c1e1aca24e396540;hb=9d306bd73bb47562cd52f0fc4cc158c534cfdfdf;hpb=220a0ce1628d376ec14394c9b0be3c10f92a4cdb

diff --git a/src/support.js b/src/support.js
index f502811..4807ce2 100644
--- a/src/support.js
+++ b/src/support.js
@@ -75,7 +75,7 @@
 	jQuery.support.optDisabled = !opt.disabled;
 
 	jQuery.support.scriptEval = function() {
-		if ( jQuery.support._scriptEval === null) {
+		if ( jQuery.support._scriptEval === null ) {
 			var root = document.documentElement,
 				script = document.createElement("script"),
 				id = "script" + jQuery.now();
@@ -101,6 +101,7 @@
 			// release memory in IE
 			root = script = id  = null;
 		}
+
 		return jQuery.support._scriptEval;
 	};
 
@@ -135,10 +136,16 @@
 	// Figure out if the W3C box model works as expected
 	// document.body must exist before we can do this
 	jQuery(function() {
-		var div = document.createElement("div");
-		div.style.width = div.style.paddingLeft = "1px";
+		var div = document.createElement("div"),
+			body = document.getElementsByTagName("body")[0];
+
+		// Frameset documents with no body should not run this code
+		if ( !body ) {
+			return;
+		}
 
-		document.body.appendChild( div );
+		div.style.width = div.style.paddingLeft = "1px";
+		body.appendChild( div );
 		jQuery.boxModel = jQuery.support.boxModel = div.offsetWidth === 2;
 
 		if ( "zoom" in div.style ) {
@@ -177,7 +184,7 @@
 		jQuery.support.reliableHiddenOffsets = jQuery.support.reliableHiddenOffsets && tds[0].offsetHeight === 0;
 		div.innerHTML = "";
 
-		document.body.removeChild( div ).style.display = "none";
+		body.removeChild( div ).style.display = "none";
 		div = tds = null;
 	});
 
@@ -187,6 +194,14 @@
 		var el = document.createElement("div");
 		eventName = "on" + eventName;
 
+		// We only care about the case where non-standard event systems
+		// are used, namely in IE. Short-circuiting here helps us to
+		// avoid an eval call (in setAttribute) which can cause CSP
+		// to go haywire. See: https://developer.mozilla.org/en/Security/CSP
+		if ( !el.attachEvent ) {
+			return true;
+		}
+
 		var isSupported = (eventName in el);
 		if ( !isSupported ) {
 			el.setAttribute(eventName, "return;");