diff --git a/includes/sanitizers/class-amp-iframe-sanitizer.php b/includes/sanitizers/class-amp-iframe-sanitizer.php index 70d1376cfbc..7b6c6ada5d6 100644 --- a/includes/sanitizers/class-amp-iframe-sanitizer.php +++ b/includes/sanitizers/class-amp-iframe-sanitizer.php @@ -132,6 +132,11 @@ public function sanitize() { if ( $this->args['add_noscript_fallback'] ) { $node->setAttribute( 'src', $normalized_attributes['src'] ); + // AMP is stricter than HTML5 for this attribute, so make sure we use a normalized value. + if ( $node->hasAttribute( 'frameborder' ) ) { + $node->setAttribute( 'frameborder', $normalized_attributes['frameborder'] ); + } + // Preserve original node in noscript for no-JS environments. $this->append_old_node_noscript( $new_node, $node, $this->dom ); } @@ -155,7 +160,7 @@ public function sanitize() { * @type bool $allowfullscreen + ', @@ -342,6 +342,38 @@ public function get_data() { 'alias_origin' => 'https://alt.example.org', ], ], + + 'iframe_with_frameborder_no' => [ + '', + ' + + + + + ', + [ + 'add_noscript_fallback' => true, + 'add_placeholder' => true, + ], + ], + + 'iframe_with_frameborder_yes' => [ + '', + ' + + + + + ', + [ + 'add_noscript_fallback' => true, + 'add_placeholder' => true, + ], + ], ]; }