Ticket #34831: 34831.diff

wp-includes/js/wp-embed.js

@@ -17 +17 @@
         }
 
         window.wp.receiveEmbedMessage = function( e ) {
-                var data = e.data;
+                var data = e.data, secret;
                 if ( ! ( data.secret || data.message || data.value ) ) {
                         return;
                 }
 
-                var iframes = document.querySelectorAll( 'iframe[data-secret="' + data.secret + '"]' ),
-                        blockquotes = document.querySelectorAll( 'blockquote[data-secret="' + data.secret + '"]' ),
+                secret = data.secret.replace( /[^a-zA-Z0-9]/g, '' );
+                if ( secret !== data.secret ) {
+                        return;
+                }
+
+                var iframes = document.querySelectorAll( 'iframe[data-secret="' + secret + '"]' ),
+                        blockquotes = document.querySelectorAll( 'blockquote[data-secret="' + secret + '"]' ),
                         i, source, height, sourceURL, targetURL;
 
                 for ( i = 0; i < blockquotes.length; i++ ) {