Add explicit variables to fix use strict.

Gruntfile.js

@@ -1025,7 +1025,8 @@ module.exports = function(grunt) {
 				src: [
 					'js/_enqueues/**/*.js',
 					// Third party scripts.
-					'!js/_enqueues/vendor/**/*.js'
+					'!js/_enqueues/vendor/**/*.js',
+					'js/_enqueues/vendor/thickbox/thickbox.js',
 				],
 				// Remove once other JSHint errors are resolved.
 				options: {

src/js/_enqueues/vendor/thickbox/thickbox.js

@@ -3,16 +3,29 @@
  * By Cody Lindley (http://www.codylindley.com)
  * Copyright (c) 2007 cody lindley
  * Licensed under the MIT License: http://www.opensource.org/licenses/mit-license.php
-*/
+ */
+
+/* global thickboxL10n, unescape */
+/* jshint -W018 */
+/* jshint -W038 */
+/* jshint -W040 */
+/* jshint -W069 */
+/* jshint -W098 */
+/* jshint -W109 */
+/* jshint -W116 */
 
 if ( typeof tb_pathToImage != 'string' ) {
 	var tb_pathToImage = thickboxL10n.loadingAnimation;
 }
 
+var imgLoader, TB_PrevCaption, TB_PrevURL, TB_PrevHTML, TB_NextCaption, TB_NextURL,
+	TB_NextHTML, TB_imageCount, TB_FoundURL, TB_TempArray, TB_Counter, TB_WIDTH, TB_HEIGHT;
+
 /*!!!!!!!!!!!!!!!!! edit below this line at your own risk !!!!!!!!!!!!!!!!!!!!!!!*/
 
 //on page load call tb_init
 jQuery(document).ready(function(){
+	'use strict';
 	tb_init('a.thickbox, area.thickbox, input.thickbox');//pass where to apply thickbox
 	imgLoader = new Image();// preload image
 	imgLoader.src = tb_pathToImage;
@@ -23,6 +36,7 @@ jQuery(document).ready(function(){
  * Remove the loading indicator when content in an iframe has loaded.
  */
 function tb_init(domChunk){
+	'use strict';
 	jQuery( 'body' )
 		.on( 'click', domChunk, tb_click )
 		.on( 'thickbox:iframe:loaded', function() {
@@ -31,6 +45,7 @@ function tb_init(domChunk){
 }
 
 function tb_click(){
+	'use strict';
 	var t = this.title || this.name || null;
 	var a = this.href || this.alt;
 	var g = this.rel || false;
@@ -40,6 +55,7 @@ function tb_click(){
 }
 
 function tb_show(caption, url, imageGroup) {//function called when the user clicks on a thickbox link
+	'use strict';
 
 	var $closeBtn;
 
@@ -87,6 +103,7 @@ function tb_show(caption, url, imageGroup) {//function called when the user clic
 			urlType == '.webp' ||
 			urlType == '.avif'
 		){//code to show images
+			var imgPreloader = new Image();
 
 			TB_PrevCaption = "";
 			TB_PrevURL = "";
@@ -117,7 +134,6 @@ function tb_show(caption, url, imageGroup) {//function called when the user clic
 				}
 			}
 
-			imgPreloader = new Image();
 			imgPreloader.onload = function(){
 			imgPreloader.onload = null;
 
@@ -150,24 +166,26 @@ function tb_show(caption, url, imageGroup) {//function called when the user clic
 
 			jQuery("#TB_closeWindowButton").on( 'click', tb_remove );
 
+			// Declared in the function scope (not the blocks below) so the keydown handler can reach them under strict mode.
+			var goPrev = function(){
+				if(jQuery(document).off("click",goPrev)){jQuery(document).off("click",goPrev);}
+				jQuery("#TB_window").remove();
+				jQuery("body").append("<div id='TB_window'></div>");
+				tb_show(TB_PrevCaption, TB_PrevURL, imageGroup);
+				return false;
+			};
+			var goNext = function(){
+				jQuery("#TB_window").remove();
+				jQuery("body").append("<div id='TB_window'></div>");
+				tb_show(TB_NextCaption, TB_NextURL, imageGroup);
+				return false;
+			};
+
 			if (!(TB_PrevHTML === "")) {
-				function goPrev(){
-					if(jQuery(document).off("click",goPrev)){jQuery(document).off("click",goPrev);}
-					jQuery("#TB_window").remove();
-					jQuery("body").append("<div id='TB_window'></div>");
-					tb_show(TB_PrevCaption, TB_PrevURL, imageGroup);
-					return false;
-				}
 				jQuery("#TB_prev").on( 'click', goPrev );
 			}
 
 			if (!(TB_NextHTML === "")) {
-				function goNext(){
-					jQuery("#TB_window").remove();
-					jQuery("body").append("<div id='TB_window'></div>");
-					tb_show(TB_NextCaption, TB_NextURL, imageGroup);
-					return false;
-				}
 				jQuery("#TB_next").on( 'click', goNext );
 
 			}
@@ -201,14 +219,15 @@ function tb_show(caption, url, imageGroup) {//function called when the user clic
 
 			var queryString = url.replace(/^[^\?]+\??/,'');
 			var params = tb_parseQuery( queryString );
+			var ajaxContentW, ajaxContentH;
 
 			TB_WIDTH = (params['width']*1) + 30 || 630; //defaults to 630 if no parameters were added to URL
 			TB_HEIGHT = (params['height']*1) + 40 || 440; //defaults to 440 if no parameters were added to URL
 			ajaxContentW = TB_WIDTH - 30;
 			ajaxContentH = TB_HEIGHT - 45;
 
 			if(url.indexOf('TB_iframe') != -1){// either iframe or ajax window
-					urlNoQuery = url.split('TB_');
+					var urlNoQuery = url.split('TB_');
 					jQuery("#TB_iframeContent").remove();
 					if(params['modal'] != "true"){//iframe no modal
 						jQuery("#TB_window").append("<div id='TB_title'><div id='TB_ajaxWindowTitle'>"+caption+"</div><div id='TB_closeAjaxWindow'><button type='button' id='TB_closeWindowButton'><span class='screen-reader-text'>"+thickboxL10n.close+"</span><span class='tb-close-icon' aria-hidden='true'></span></button></div></div><iframe frameborder='0' hspace='0' allowtransparency='true' src='"+urlNoQuery[0]+"' id='TB_iframeContent' name='TB_iframeContent"+Math.round(Math.random()*1000)+"' onload='tb_showIframe()' style='width:"+(ajaxContentW + 29)+"px;height:"+(ajaxContentH + 17)+"px;' >"+thickboxL10n.noiframes+"</iframe>");
@@ -285,11 +304,13 @@ function tb_show(caption, url, imageGroup) {//function called when the user clic
 
 //helper functions below
 function tb_showIframe(){
+	'use strict';
 	jQuery("#TB_load").remove();
 	jQuery("#TB_window").css({'visibility':'visible'}).trigger( 'thickbox:iframe:loaded' );
 }
 
 function tb_remove() {
+	'use strict';
  	jQuery("#TB_imageOff").off("click");
 	jQuery("#TB_closeWindowButton").off("click");
 	jQuery( '#TB_window' ).fadeOut( 'fast', function() {
@@ -307,6 +328,7 @@ function tb_remove() {
 }
 
 function tb_position() {
+	'use strict';
 var isIE6 = typeof document.body.style.maxHeight === "undefined";
 jQuery("#TB_window").css({marginLeft: '-' + parseInt((TB_WIDTH / 2),10) + 'px', width: TB_WIDTH + 'px'});
 	if ( ! isIE6 ) { // take away IE6
@@ -315,6 +337,7 @@ jQuery("#TB_window").css({marginLeft: '-' + parseInt((TB_WIDTH / 2),10) + 'px',
 }
 
 function tb_parseQuery ( query ) {
+   'use strict';
    var Params = {};
    if ( ! query ) {return Params;}// return empty object
    var Pairs = query.split(/[;&]/);
@@ -330,14 +353,15 @@ function tb_parseQuery ( query ) {
 }
 
 function tb_getPageSize(){
+	'use strict';
 	var de = document.documentElement;
 	var w = window.innerWidth || self.innerWidth || (de&&de.clientWidth) || document.body.clientWidth;
 	var h = window.innerHeight || self.innerHeight || (de&&de.clientHeight) || document.body.clientHeight;
-	arrayPageSize = [w,h];
-	return arrayPageSize;
+	return [w,h];
 }
 
 function tb_detectMacXFF() {
+  'use strict';
   var userAgent = navigator.userAgent.toLowerCase();
   if (userAgent.indexOf('mac') != -1 && userAgent.indexOf('firefox')!=-1) {
     return true;

tests/qunit/wp-includes/js/thickbox.js

@@ -0,0 +1,48 @@
+/* jshint evil: true */
+
+(function (QUnit) {
+	QUnit.module('thickbox');
+
+	QUnit.test(
+		'initializes when concatenated after a strict-mode script',
+		function (assert) {
+			var done = assert.async();
+
+			assert.expect(1);
+
+			jQuery
+				.get('../../src/js/_enqueues/vendor/thickbox/thickbox.js')
+				.done(function (source) {
+					var thickboxL10n = {
+						loadingAnimation: 'loading.gif',
+					};
+					var fakejQuery = function () {
+						return {
+							ready: function (callback) {
+								callback();
+							},
+							on: function () {
+								return this;
+							},
+						};
+					};
+
+					assert.doesNotThrow(function () {
+						Function(
+							'jQuery',
+							'thickboxL10n',
+							'document',
+							'Image',
+							'"use strict";\n' + source
+						)(fakejQuery, thickboxL10n, {}, window.Image);
+					});
+
+					done();
+				})
+				.fail(function () {
+					assert.ok(false, 'Could not load thickbox.js source.');
+					done();
+				});
+		}
+	);
+})(window.QUnit);