Lack of null check in wp-embed.js causes uncaught error to be thrown under certain circumstances.

[dsifford]

The file and lines in question can be seen here: ​https://github.com/WordPress/WordPress/blob/5bbb3b38d96eb0aac29d3b368d541039a3b1fbb8/wp-includes/js/wp-embed.js#L31-L33

The issue specifically is that currently the script assumes there will always be a data parameter on message. This is not true in the case of Google ReCAPTCHA (and I assume many other 3rd party scripts).

In these cases, data is null and when attempting to access properties on null, an error is thrown.

This all can be fixed by changing the if statement from what it is currently to:

if ( data && ! ( data.secret || data.message || data.value ) ) {
	return;
}

[swissspidy]

Good catch! Although your proposed change wouldn't actually return early when data is null.

It would be more something like

if ( ! data || ! ( data.secret || data.message || data.value ) ) {
	return;
}

[dsifford]

D'oh! You're right!

I agree with your suggested change to my suggested change. :)

[SergeyBiryukov]

Just stumbled upon this while setting up reCAPTCHA. Moving to 4.9.9 for visibility.

[dsifford]

Patch (hope I did this correctly)

[kadamwhite]

Adjust patch for trunk JS reorganization

[SergeyBiryukov]

In 43593:

Embeds: Avoid a JS error in wp.receiveEmbedMessage if data parameter is not set.

Props dsifford, kadamwhite.
Fixes #44832.

[SergeyBiryukov]

Reopening for 4.9.9 consideration.

[SergeyBiryukov]

In 43597:

Embeds: After [43593], move the new check to a separate line to avoid test_js_no_ampersands_in_compiled failure caused by UglifyJS task.

See #44832.

[SergeyBiryukov]

In 43600:

Embeds: Avoid a JS error in wp.receiveEmbedMessage if data parameter is not set.

Props dsifford, kadamwhite.
Merges [43593] and [43597] to the 4.9 branch.
Fixes #44832.

[robhenley]

I agree the check should be there but isn't the issue the generic "message" event that both wp-embed.min.js and Recaptcha's recaptcha__en.js are using? So receiveEmbedMessage is being called by Recaptcha without the proper arguments.

[pento]

[43600] can be ported to the 5.0 branch.

[SergeyBiryukov]

In 43704:

Embeds: Avoid a JS error in wp.receiveEmbedMessage if data parameter is not set.

Props dsifford, kadamwhite.
Merges [43593] and [43597] to the 5.0 branch.
Fixes #44832.