Changeset 10520

Timestamp:

12/16/2020 07:30:13 AM (4 years ago)

Author:

dd32

Message:

Theme Preview: Prevent navigation to external urls that are not WordPress.org hosted.

As these previews are used within iframes on WordPress sites we need to ensure that only sites we control can be loaded within the iframe.

File:

• sites/trunk/wp-themes.com/public_html/wp-content/mu-plugins/pub/open-links-in-new-window.php (modified) (1 diff)

sites/trunk/wp-themes.com/public_html/wp-content/mu-plugins/pub/open-links-in-new-window.php

@@ -3 +3 @@
 /**
  * Plugin Name: Open external links in new window/tab.
- * Description: Injects some JS to cause all external links to open in a new tab, to work around X-Frame-Options (and presenting something as WordPress.org that isn't).
+ * Description: Injects some JS to WordPress.org links to open in a new tab, and prevent navigation to other hostnames breaking preview iframes.
  */
 
 add_action( 'wp_footer', function() {
     echo '<script>
-( function( base ) {
+( function() {
     var links = document.getElementsByTagName( "a" );
     for ( var i = 0; i < links.length; i++ ) {
-        var href = links[i].href.split( "#" )[0];
-        if ( href && base !== href.substring( 0, base.length ) ) {
-            links[i].target = "_blank";
+        var link = links[i],
+            url,
+            hostname;
+
+        try {
+            url      = new URL( link.href, document.location.href );
+            hostname = url.hostname;
+            if ( "mailto:" === url.protocol ) {
+                hostname = "mailto"; // not whitelisted hostname to fall through.
+            }
+        } catch( e ) {
+            // Internet Explorer and invalid links, fall back to regex.
+            if ( hostname = link.href.match( /^\s*(?:(?:https?:)?\/\/)([^/]+)(\/|$)/ ) ) {
+                hostname = hostname[0];
+            }
         }
+
+        // Self links are allowed.
+        if ( ! hostname || "wp-themes.com" === hostname ) {
+            continue;
+        }
+
+        // Links to WordPress.org should be allowed, but open in a new window.
+        if ( "wordpress.org" === hostname || ".wordpress.org" === hostname.substr(-14) ) {
+            link.target = "_blank";
+            continue;
+        }
+
+        // The link should not be followed, but the href is kept to allow for a[href^=] based styling.
+        link.addEventListener( "click", function( e ) {
+            e.preventDefault();
+        } );
     }
-} )( ' . wp_json_encode( home_url( '/' ) ) . ')
+} )();
 </script>';
-} );
+}, 9999 );