Changeset 55768

Timestamp:

05/16/2023 02:45:37 PM (19 months ago)

Author:

audrasjb

Message:

Embeds: Add protocol validation for WordPress Embed code.

Validate that links within auto-discovered embeds are using the http or https protocols before following links.

Props xknown, dd32, peterwilsoncc.
Merges [55763] to branch 6.2.

File:

• branches/6.2/src/js/_enqueues/wp/embed.js (modified) (2 diffs)

branches/6.2/src/js/_enqueues/wp/embed.js

@@ -50 +50 @@
         var iframes = document.querySelectorAll( 'iframe[data-secret="' + data.secret + '"]' ),
             blockquotes = document.querySelectorAll( 'blockquote[data-secret="' + data.secret + '"]' ),
+            allowedProtocols = new RegExp( '^https?:$', 'i' ),
             i, source, height, sourceURL, targetURL;
 
@@ -84 +85 @@
                 sourceURL.href = source.getAttribute( 'src' );
                 targetURL.href = data.value;
+
+                /* Only follow link if the protocol is in the allow list. */
+                if ( ! allowedProtocols.test( targetURL.protocol ) ) {
+                    continue;
+                }
 
                 /* Only continue if link hostname matches iframe's hostname. */