Restrict AMP attributes to media and embeds only.

ampproject · May 4, 2018 · 369650e · 369650e
1 parent 9e54106
commit 369650e
Show file tree

Hide file tree

Showing 2 changed files with 30 additions and 14 deletions.
diff --git a/assets/js/amp-editor-blocks.js b/assets/js/amp-editor-blocks.js
@@ -20,7 +20,12 @@ var ampEditorBlocks = ( function() {
 				{ value: 'intrinsic', label: 'Intrinsic' } // Not supported by video.
 			],
 			defaultWidth: 608, // Max-width in the editor.
-			defaultHeight: 400
+			defaultHeight: 400,
+			mediaBlocks: [
+				'core/image',
+				'core/video',
+				'core/audio'
+			]
 		}
 	};
 
@@ -96,12 +101,6 @@ var ampEditorBlocks = ( function() {
 	 * @return {*} Settings.
 	 */
 	component.addAMPAttributes = function addAMPAttributes( settings, name ) {
-		var mediaBlocks = [
-			'core/image',
-			'core/video',
-			'core/audio'
-		];
-
 		// Gallery settings for shortcode.
 		if ( 'core/shortcode' === name ) {
 			if ( ! settings.attributes ) {
@@ -113,7 +112,7 @@ var ampEditorBlocks = ( function() {
 		}
 
 		// Layout settings for embeds and media blocks.
-		if ( 0 === name.indexOf( 'core-embed' ) || -1 !== mediaBlocks.indexOf( name ) ) {
+		if ( 0 === name.indexOf( 'core-embed' ) || -1 !== component.data.mediaBlocks.indexOf( name ) ) {
 			if ( ! settings.attributes ) {
 				settings.attributes = {};
 			}
@@ -164,12 +163,11 @@ var ampEditorBlocks = ( function() {
 						}, props ) )
 					];
 				}
-			} else {
+			} else if ( -1 !== component.data.mediaBlocks.indexOf( name ) || 0 === name.indexOf( 'core-embed/' ) ) {
 				inspectorControls = component.setUpInspectorControls( props );
 			}
 
-			// For editor view, add a wrapper to any tags except for embeds, these will break due to embedding logic.
-			if ( attributes.ampLayout && -1 === name.indexOf( 'core-embed/' ) ) {
+			if ( attributes.ampLayout ) {
 				if ( 'core/image' === name ) {
 					component.setImageBlockLayoutAttributes( props, attributes.ampLayout, inspectorControls );
 				} else if ( 'nodisplay' === attributes.ampLayout ) {

diff --git a/includes/admin/class-amp-editor-blocks.php b/includes/admin/class-amp-editor-blocks.php
@@ -17,6 +17,7 @@ class AMP_Editor_Blocks {
 	public function init() {
 		if ( function_exists( 'gutenberg_init' ) ) {
 			add_action( 'admin_enqueue_scripts', array( $this, 'add_editor_filters' ) );
+			add_filter( 'wp_kses_allowed_html', array( $this, 'whitelist_layout_in_wp_kses_allowed_html' ), 10 );
 		}
 	}
 
@@ -53,10 +54,13 @@ public static function filter_rest_pre_insert_post( $prepared_post ) {
 				}
 				$class_names = explode( ' ', $match[1] );
 				$class_attr  = array();
+				if ( isset( $block['attrs']['className'] ) ) {
+					$class_attr[] = $block['attrs']['className'];
+				}
 
 				// Take everything except for the wp-block-{block_type} class.
 				foreach ( $class_names as $class_name ) {
-					if ( false === strpos( $class_name, 'wp-block-' ) ) {
+					if ( false !== strpos( $class_name, 'amp-' ) ) {
 						$class_attr[] = $class_name;
 					}
 				}
@@ -69,8 +73,8 @@ public static function filter_rest_pre_insert_post( $prepared_post ) {
 					array(
 						'className' => implode( ' ', $class_attr ),
 					)
-				) );
-				$to_replace     = wp_json_encode( $block['attrs'] );
+				), 64 /* JSON_UNESCAPED_SLASHES */ );
+				$to_replace     = wp_json_encode( $block['attrs'], 64 /* JSON_UNESCAPED_SLASHES */ );
 
 				// Replace the classname attribute with the modified one.
 				$content                     = str_replace( $to_replace, $new_attributes, $prepared_post->post_content );
@@ -80,6 +84,20 @@ public static function filter_rest_pre_insert_post( $prepared_post ) {
 		return $prepared_post;
 	}
 
+	/**
+	 * Whitelist used data-amp-* attributes.
+	 *
+	 * @param array $context Array of contexts.
+	 * @return mixed Modified array.
+	 */
+	public function whitelist_layout_in_wp_kses_allowed_html( $context ) {
+		foreach ( $context as $tag ) {
+			$tag['data-amp-layout']    = true;
+			$tag['data-amp-noloading'] = true;
+		}
+		return $context;
+	}
+
 	/**
 	 * Enqueue filters for extending core blocks attributes.
 	 * Has to be loaded before registering the blocks in registerCoreBlocks.