Changeset 64489 for trunk/src/wp-includes/deprecated.php

Timestamp:

10/18/2026 10:32:14 PM (39 hours ago)

Author:

adamsilverstein

Message:

Media: stop adding crossorigin attributes in the editor.

Fix an issue where editing a post in Chromium 137+ could end in a fatal error and a blank screen when the page loaded any cross-origin resource. wp_add_crossorigin_attributes() ran WP_HTML_Tag_Processor over the whole document inside an ob_start() display handler, where errors cannot be caught. The injected crossorigin="anonymous" was not needed in the first place: Document-Isolation-Policy: isolate-and-credentialless loads cross-origin scripts, stylesheets, audio and video without credentials instead of blocking them, and forcing a CORS request broke any host that does not send Access-Control-Allow-Origin, such as media offloaded to a CDN.

The header is now sent directly by the new wp_send_document_isolation_policy_header(), and the editor page is no longer buffered or rewritten. wp_start_cross_origin_isolation_output_buffer() and wp_add_crossorigin_attributes() are deprecated; the first only sends the header and the second returns the HTML unchanged. wp_print_media_templates() no longer adds the attribute to AUDIO and VIDEO tags. Cross-origin isolation and client-side media processing are unaffected.

Follow-up to [61844], [62048], [62819].

Props b0b3k, khokansardar, arkaprabhachowdhury, westonruter, andrewserong, algorithmsunlocks, sabernhardt, swissspidy, adamsilverstein.
Fixes #65930. See #65673.

File:

• trunk/src/wp-includes/deprecated.php (modified) (1 diff)

trunk/src/wp-includes/deprecated.php

@@ -6601 +6601 @@
         return wp_truncate_slug( $slug, $length );
 }
+
+/**
+ * Starts an output buffer that sends the Document-Isolation-Policy header
+ * and adds crossorigin="anonymous" to cross-origin resources.
+ *
+ * The attribute injection was dropped because `isolate-and-credentialless`
+ * loads cross-origin resources without it, and forcing CORS mode broke
+ * resources served without `Access-Control-Allow-Origin`. Only the header
+ * is sent now.
+ *
+ * @since 7.1.0
+ * @deprecated 7.2.0 Use wp_send_document_isolation_policy_header() instead.
+ * @see wp_send_document_isolation_policy_header()
+ */
+function wp_start_cross_origin_isolation_output_buffer(): void {
+        _deprecated_function( __FUNCTION__, '7.2.0', 'wp_send_document_isolation_policy_header()' );
+
+        wp_send_document_isolation_policy_header();
+}
+
+/**
+ * Adds crossorigin="anonymous" to relevant tags in the given HTML string.
+ *
+ * No longer modifies the HTML. Under `Document-Isolation-Policy:
+ * isolate-and-credentialless` cross-origin resources load without the
+ * attribute, and adding it broke resources served without CORS headers.
+ *
+ * @since 7.1.0
+ * @deprecated 7.2.0
+ *
+ * @param string $html HTML input.
+ * @return string The unmodified HTML.
+ */
+function wp_add_crossorigin_attributes( string $html ): string {
+        _deprecated_function( __FUNCTION__, '7.2.0' );
+
+        return $html;
+}