Normalize frameborder=no|yes to frameborder=0|1 in iframe sanitizer

[westonruter]

When adding an iframe such as:

<iframe frameborder="no" height="200" scrolling="no" src="https://player.megaphone.fm/DEM1119155060?" width="100%"></iframe>

It gets converted into an amp-iframe successfully as:

<amp-iframe frameborder="0" height="200" scrolling="no" src="https://player.megaphone.fm/DEM1119155060?" width="640" sandbox="allow-scripts allow-same-origin" layout="intrinsic" class="amp-wp-enforced-sizes">
    <span placeholder="" class="amp-wp-iframe-placeholder"></span>
    <noscript>
        <iframe height="200" scrolling="no" src="https://player.megaphone.fm/DEM1119155060?" width="100%"></iframe>
    </noscript>
</amp-iframe>

Nevertheless, one AMP validation error is raised in the process:

This validation error is pointless, however, because the iframe that amp-iframe component generates already provides frameborder=0:

It seems that while HTML allows no as a synonym for 0 (and yes for 1), this is not supported by AMP:

  attrs: {
    name: "frameborder"
    value: "0"
    value: "1"
  }

Apparently this is not even allowed in HTML4, so it could just be a common author mistake (which browsers gracefully handle, and it has been deprecated/removed in HTML5):

  frameborder (1|0)          1         -- request frame borders? --

The AMP plugin makes the default frameborder=0 as seen in the generated example above. What is missing is when the $value is no it should be normalized to 0, and when yes normalized to 1:

amp-wp/includes/sanitizers/class-amp-iframe-sanitizer.php

Lines 153 to 158 in 437c335

	case 'frameborder':
	if ( '0' !== $value && '1' !== $value ) {
	$value = '0';
	}
	$out[ $name ] = $value;
	break;

This will prevent a validation error from being raised, and it will allow iframe[frameborder=yes] to actually result in amp-iframe[frameborder=1] as the user intends.

[swissspidy]

so it could just be a common author mistake (which browsers gracefully handle

Perhaps that comes from the other frame elements:

A frameset or frame element has a border if the following algorithm returns true:

If the element has a frameborder attribute whose value is not the empty string and whose first character is either a U+0031 DIGIT ONE (1) character, a U+0079 LATIN SMALL LETTER Y character (y), or a U+0059 LATIN CAPITAL LETTER Y character (Y), then return true.

Interesting read :)

[westonruter]

Good find. So it's not just yes and no but y and n that we also should handle 😄