Changeset 64489 for trunk/src/wp-includes/media.php

Timestamp:

10/18/2026 10:32:14 PM (40 hours ago)

Author:

adamsilverstein

Message:

Media: stop adding crossorigin attributes in the editor.

Fix an issue where editing a post in Chromium 137+ could end in a fatal error and a blank screen when the page loaded any cross-origin resource. wp_add_crossorigin_attributes() ran WP_HTML_Tag_Processor over the whole document inside an ob_start() display handler, where errors cannot be caught. The injected crossorigin="anonymous" was not needed in the first place: Document-Isolation-Policy: isolate-and-credentialless loads cross-origin scripts, stylesheets, audio and video without credentials instead of blocking them, and forcing a CORS request broke any host that does not send Access-Control-Allow-Origin, such as media offloaded to a CDN.

The header is now sent directly by the new wp_send_document_isolation_policy_header(), and the editor page is no longer buffered or rewritten. wp_start_cross_origin_isolation_output_buffer() and wp_add_crossorigin_attributes() are deprecated; the first only sends the header and the second returns the HTML unchanged. wp_print_media_templates() no longer adds the attribute to AUDIO and VIDEO tags. Cross-origin isolation and client-side media processing are unaffected.

Follow-up to [61844], [62048], [62819].

Props b0b3k, khokansardar, arkaprabhachowdhury, westonruter, andrewserong, algorithmsunlocks, sabernhardt, swissspidy, adamsilverstein.
Fixes #65930. See #65673.

File:

• trunk/src/wp-includes/media.php (modified) (5 diffs)

trunk/src/wp-includes/media.php

@@ -6649 +6649 @@
  *
  * @since 7.1.0
- */
-function wp_set_up_cross_origin_isolation(): void {
+ * @since 7.2.0 Returns whether the header was sent.
+ *
+ * @return bool Whether the Document-Isolation-Policy header was sent.
+ */
+function wp_set_up_cross_origin_isolation(): bool {
         if ( ! wp_is_client_side_media_processing_enabled() ) {
-                return;
+                return false;
         }
 
@@ -6658 +6661 @@
 
         if ( ! $screen ) {
-                return;
+                return false;
         }
 
         if ( ! $screen->is_block_editor() && 'site-editor' !== $screen->id && ! ( 'widgets' === $screen->id && wp_use_widgets_block_editor() ) ) {
-                return;
+                return false;
         }
 
@@ -6678 +6681 @@
         // phpcs:ignore WordPress.Security.NonceVerification.Recommended
         if ( 'site-editor.php' === $pagenow && ! wp_is_block_theme() && ( ! isset( $_GET['p'] ) || '/' === $_GET['p'] ) ) {
-                return;
+                return false;
         }
 
@@ -6687 +6690 @@
          */
         if ( isset( $_GET['action'] ) && 'edit' !== $_GET['action'] ) {
-                return;
+                return false;
         }
 
         // Cross-origin isolation is not needed if users can't upload files anyway.
         if ( ! current_user_can( 'upload_files' ) ) {
-                return;
-        }
-
-        wp_start_cross_origin_isolation_output_buffer();
+                return false;
+        }
+
+        return wp_send_document_isolation_policy_header();
 }
 
@@ -6701 +6704 @@
  * Sends the Document-Isolation-Policy header for cross-origin isolation.
  *
- * Uses an output buffer to add crossorigin="anonymous" where needed.
- *
- * @since 7.1.0
- */
-function wp_start_cross_origin_isolation_output_buffer(): void {
+ * The `isolate-and-credentialless` directive loads cross-origin subresources
+ * without credentials instead of blocking them, so no `crossorigin` attribute
+ * is needed on scripts, styles, images, audio, or video for the page to work.
+ * Forcing `crossorigin="anonymous"` would turn those into CORS requests
+ * and break any resource served without `Access-Control-Allow-Origin`.
+ *
+ * @since 7.2.0
+ *
+ * @return bool Whether the header was sent. False if the browser does not
+ *              support Document-Isolation-Policy or headers were already sent.
+ */
+function wp_send_document_isolation_policy_header(): bool {
+        if ( headers_sent() ) {
+                return false;
+        }
+
         $chromium_version = wp_get_chromium_major_version();
 
         if ( null === $chromium_version || $chromium_version < 137 ) {
-                return;
-        }
-
-        ob_start(
-                static function ( string $output ): string {
-                        header( 'Document-Isolation-Policy: isolate-and-credentialless' );
-
-                        return wp_add_crossorigin_attributes( $output );
-                }
-        );
-}
-
-/**
- * Adds crossorigin="anonymous" to relevant tags in the given HTML string.
- *
- * @since 7.1.0
- *
- * @param string $html HTML input.
- * @return string Modified HTML.
- */
-function wp_add_crossorigin_attributes( string $html ): string {
-        $site_url = site_url();
-
-        $processor = new WP_HTML_Tag_Processor( $html );
-
-        // See https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/crossorigin.
-        $cross_origin_tag_attributes = array(
-                'AUDIO'  => array( 'src' ),
-                'LINK'   => array( 'href' ),
-                'SCRIPT' => array( 'src' ),
-                'VIDEO'  => array( 'src', 'poster' ),
-                'SOURCE' => array( 'src' ),
-        );
-
-        while ( $processor->next_tag() ) {
-                $tag = $processor->get_tag();
-
-                if ( ! isset( $cross_origin_tag_attributes[ $tag ] ) ) {
-                        continue;
-                }
-                $crossorigin = $processor->get_attribute( 'crossorigin' );
-                if ( null !== $crossorigin ) {
-                        continue;
-                }
-
-                if ( 'AUDIO' === $tag || 'VIDEO' === $tag ) {
-                        $processor->set_bookmark( 'audio-video-parent' );
-                }
-
-                $processor->set_bookmark( 'resume' );
-
-                $sought = false;
-
-                $is_cross_origin = false;
-
-                foreach ( $cross_origin_tag_attributes[ $tag ] as $attr ) {
-                        $url = $processor->get_attribute( $attr );
-                        if ( is_string( $url ) && ! str_starts_with( $url, $site_url ) && ! str_starts_with( $url, '/' ) ) {
-                                $is_cross_origin = true;
-                        }
-
-                        if ( $is_cross_origin ) {
-                                break;
-                        }
-                }
-
-                if ( $is_cross_origin ) {
-                        if ( 'SOURCE' === $tag ) {
-                                $sought = $processor->seek( 'audio-video-parent' );
-
-                                if ( $sought ) {
-                                        $processor->set_attribute( 'crossorigin', 'anonymous' );
-                                }
-                        } else {
-                                $processor->set_attribute( 'crossorigin', 'anonymous' );
-                        }
-
-                        if ( $sought ) {
-                                $processor->seek( 'resume' );
-                                $processor->release_bookmark( 'audio-video-parent' );
-                        }
-                }
-        }
-
-        return $processor->get_updated_html();
-}
-
+                return false;
+        }
+
+        header( 'Document-Isolation-Policy: isolate-and-credentialless' );
+
+        return true;
+}
+