Repository navigation
fix(security): restrict iframe allow policy to low-risk features - #27
Merged
Merged
Conversation
Users without unfiltered_html could set an arbitrary `allow` value and delegate camera, microphone, geolocation or display-capture to any embedded origin. - Filter `allow` directives against an allowlist (filterable on the front end with `blockparty_iframe_allowed_features`) and drop origin lists, in PHP and in the editor preview. - Stop rendering the obsolete `allowpaymentrequest` attribute. Co-Authored-By: Claude Opus 5.5 <[email protected]>
Render the editor preview through BlockRenderer so iframe attribute filtering lives in PHP only, and the `blockparty_iframe_allowed_features` filter applies to the preview too. - Use ServerSideRender (default import, WordPress 6.7 compatible) with skipBlockSupportAttributes; drop convertAttributesToProps(), sanitizeAllowValue() and the JS ALLOWED_FEATURES list. - Make the nested preview markup fill the block wrapper in the editor. - Check aria-*/data-* attribute prefixes with str_starts_with() and startsWith() instead of a regex. Co-Authored-By: Claude Opus 5.5 <[email protected]>
The server-side preview used the saved block attributes, while "View" shows the form before "Add iframe" saves it. A new block or a "Replace" edit then previewed an empty or stale iframe. Merge the form state into the attributes sent to ServerSideRender, as the former JS preview did. Co-Authored-By: Claude Opus 5.5 <[email protected]>
skipBlockSupportAttributes keeps `style.dimensions`, so the server-side preview markup got the aspect ratio again inside the block wrapper and overflowed it. Drop `align` and `style` from the preview attributes: the editor wrapper already applies them. Co-Authored-By: Claude Opus 5.5 <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #24. Deploys to
mainthe ticket branch already merged intodevelopthrough #25.Why
Users without
unfiltered_htmlcould set anyallowvalue on the iframe and delegate camera, microphone, geolocation or screen capture to an embedded third-party page.What
allowkeeps only low-risk Permissions Policy features (accelerometer,autoplay,clipboard-write,encrypted-media,fullscreen,gyroscope,picture-in-picture,web-share) and drops origin lists. The list can be extended with theblockparty_iframe_allowed_featuresfilter.allowpaymentrequestis no longer rendered.ServerSideRender, so filtering lives only inBlockRenderer. Adds the@wordpress/server-side-renderdependency (6.20.0).Details and review history: #25.
Test plan
npm run lint:js src,phpcs,npm run buildwp-env): sensitiveallowdirectives andonloaddropped in the preview and on the front endblockparty_iframe_allowed_featuresapplied to the previewRelease note
.plugin-datastill says1.2.1, which is already tagged, so the version check onmainwill fail until the version is bumped (previous releases did this in arelease/*branch).🤖 Generated with Claude Code
Note
Medium Risk
Changes security-sensitive iframe attribute sanitization and the editor preview path; regressions could affect preview layout or which
allowdirectives appear, but the change narrows delegated permissions rather than expanding them.Overview
Tightens iframe Permissions Policy handling so the
allowattribute only keeps a fixed set of low-risk features, strips origin lists (features apply to the iframe origin only), and drops obsoleteallowpaymentrequestoutput. Site owners can extend the feature list via the newblockparty_iframe_allowed_featuresfilter.The block editor preview no longer renders a client-side
<iframe>with duplicated JS allowlists; it usesServerSideRenderso preview and front end both go throughBlockRenderer.php, where attribute/allowfiltering is the single security boundary. Adds@wordpress/server-side-renderand editor CSS so the nested preview fills the block wrapper dimensions.Reviewed by Cursor Bugbot for commit e9d9e51. Bugbot is set up for automated code reviews on this repo. Configure here.