Changeset 15149

Timestamp:

09/04/2026 08:28:19 PM (2 weeks ago)

Author:

obenland

Message:

Trac oEmbed: Apply the iframe's sandbox flags to the embed response

Closes ​https://github.com/WordPress/wordpress.org/pull/876.

File:

• sites/trunk/api.wordpress.org/public_html/dotorg/trac/oembed/index.php (modified) (3 diffs)

sites/trunk/api.wordpress.org/public_html/dotorg/trac/oembed/index.php

@@ -150 +150 @@
 header( 'X-Content-Type-Options: nosniff' );
 
+/*
+ * The iframe's sandbox covers that element, not this response, which is reachable directly.
+ * Re-serving third-party markup is the point of this endpoint, so the sandbox is the boundary
+ * rather than the markup: the document cannot act as this origin, and it shows nothing the Trac
+ * URL it mirrors does not already show to the same audience.
+ */
+header( 'Content-Security-Policy: sandbox allow-scripts allow-top-navigation-by-user-activation' );
+
 $cache_key = sha1( $url );
 if ( $data = wp_cache_get( $cache_key, 'trac-oembed' ) ) {
@@ -309 +317 @@
 $js = <<<JS
 (function() {
+        if ( window.parent === window ) {
+                return;
+        }
+
         var id = ( document.location.hash.match(/el=([0-9a-f]+)(&|$)/) || [ '', '' ] )[1];
 
@@ -324 +336 @@
 })();
 JS;
-$doc->getElementsByTagName( 'head' )[0]->appendChild( $doc->createElement( 'script', $js ) );
+
+$reporter = $doc->createElement( 'script' );
+$reporter->appendChild( $doc->createTextNode( $js ) );
+$doc->getElementsByTagName( 'head' )[0]->appendChild( $reporter );
 
 $css = <<<CSS