Add security hardenings to $.ajax()

[LukasReschke]

Adds two security hardening to $.ajax:

1. Do not add sensitive request headers for cross domain requests
   • Prevents leaking the CSRF token to another third-party domain by mistake. (fixes requesttoken.js verify that request goes to ownCloud domain #16926)
2. Disable automatic evaluation of responses
   • If a response to a $.ajax() request returns a content type of "application/javascript"
     JQuery would previously execute the response body. This is a pretty unexpected
     behaviour and can result in a bypass of our Content-Security-Policy as well as
     multiple unexpected XSS vectors.

[scrutinizer-notifier]

A new inspection was created.

[LukasReschke]

@MorrisJobke @nickvergessen Mind testing? :)

[icewind1991]

Disable automatic evaluation of responses

Does this effect $.getScript ?

[LukasReschke]

Does this effect $.getScript ?

No. $.getScript is overriding the default behaviour. $.getScript will still behave as before.

Tested with:

$.get('http://localhost/test.php');

$.getScript('http://localhost/test.php');

<?php
header('Content-Type: application/javascript');
?>
alert(1);

[icewind1991]

👍

[rullzer]

Looks good! And your testcase works as expected. 👍

[VicDeo]

👍 Tested