Code

Experimental: Add sandboxing levels#6546

Code

Merged

westonruter merged 90 commits intodevelopampproject/amp-wp:developfrom add/sandboxing-levelsampproject/amp-wp:add/sandboxing-levelsCopy head branch name to clipboardOct 13, 2021

+3,383-859

Commits

Commits on Sep 4, 2021

• Add initial sandboxing levels

  westonruter

  committed
  fb612c2

  Copy full SHA for fb612c2

• Opt-in to new script sanitizer and allowing post forms even in level 3

  westonruter

  committed
  73869b6

  Copy full SHA for 73869b6

• Prevent service from running during unit tests (for now)

  westonruter

  committed
  c1f6a7e

  Copy full SHA for c1f6a7e

• Fix AMP_Script_Sanitizer arg key

  westonruter

  committed
  847b432

  Copy full SHA for 847b432

• Discontinue overloading data-ampdevmode in favor of specific flags for doc, tag, and attrs

  westonruter

  committed
  d615b57

  Copy full SHA for d615b57

• Default sandboxing to off, requiring filter to enable instead of WP_DEBUG

  westonruter

  committed
  7aa81d6

  Copy full SHA for 7aa81d6

• Set order for sanitizers to run in

  westonruter

  committed
  e988c54

  Copy full SHA for e988c54

• Prefer bento from script sanitizer when custom scripts kept

  westonruter

  committed
  bb3d682

  Copy full SHA for bb3d682

• Move logic to set unvalidated attrs to base removal methods

  westonruter

  committed
  a9bab8a

  Copy full SHA for a9bab8a

• Dynamically switch to Bento when non-valid document and when Bento components used

  westonruter

  committed
  cfcd5d8

  Copy full SHA for cfcd5d8

• Remove bento as automatically triggering dev mode

  westonruter

  committed
  e4e2301

  Copy full SHA for e4e2301

• Add todos to revisit in future

  westonruter

  committed
  a163249

  Copy full SHA for a163249

• Conditionally add document.write override only if amp-live-list is in doc

  westonruter

  committed
  a840c88

  Copy full SHA for a840c88

• Introduce native_video_used arg for AMP_Video_Sanitizer

  westonruter

  committed
  7aa7d09

  Copy full SHA for 7aa7d09

• Introduce native_audio_used arg for AMP_Audio_Sanitizer

  westonruter

  committed
  12da9c7

  Copy full SHA for 12da9c7

• Use native audio/video elements when custom scripts are kept

  westonruter

  committed
  5570f16

  Copy full SHA for 5570f16

• Indicate sandboxing level in AMP meta generator

  westonruter

  committed
  a6f2647

  Copy full SHA for a6f2647

• Use native iframes when custom scripts are kept

  westonruter

  committed
  793beb4

  Copy full SHA for 793beb4

• Add test to ensure that the script sanitizer sets prefer_bento

  westonruter

  committed
  4fc05bc

  Copy full SHA for 4fc05bc

• Reduce code duplication

  westonruter

  committed
  f45aec6

  Copy full SHA for f45aec6

• Initial success with comment reply links

  westonruter

  committed
  de4d94a

  Copy full SHA for de4d94a

• Simplify state

  westonruter

  committed
  d250f6f

  Copy full SHA for d250f6f

• Focus on comment textarea when clicking on reply

  westonruter

  committed
  bdc94ab

  Copy full SHA for bdc94ab

• Remove commented-out code and add deprecations

  westonruter

  committed
  e8f66e5

  Copy full SHA for e8f66e5

• Update comment

  westonruter

  committed
  6245411

  Copy full SHA for 6245411

• Mark script output from wp_comment_form_unfiltered_html_nonce() as being in dev mode

  westonruter

  committed
  5d42136

  Copy full SHA for 5d42136

• Run core theme sanitizer before script sanitizer

  westonruter

  committed
  758c53a

  Copy full SHA for 758c53a

• Greatly simplify thread_comments handling in comment sanitizer

  westonruter

  committed
  99893db

  Copy full SHA for 99893db

• Only unwrap noscripts when no PX-verified scripts present either

  westonruter

  committed
  0295046

  Copy full SHA for 0295046

• Prevent removal of PX-validated custom tags

  westonruter

  committed
  ca10637

  Copy full SHA for ca10637

• Remove amp attribute from pages containing PX-verified attrs

  westonruter

  committed
  015bf10

  Copy full SHA for 015bf10

• Rework form sanitizer to always leave POST forms alone or convert

  Show description for f91fa9d
  westonruter

  committed
  f91fa9d

  Copy full SHA for f91fa9d

• Test keeping non-AMP custom elements and prevent double reporting

  westonruter

  committed
  cf2272b

  Copy full SHA for cf2272b

• Remove completed todos

  westonruter

  committed
  ade01cf

  Copy full SHA for ade01cf

• Fix typo in comments_live_list

  Show description for dad92a8
  westonruter

  committed
  dad92a8

  Copy full SHA for dad92a8

• Introduce ValidationExemption class to centralize AMP-unvalidated and PX-verified logic

  westonruter

  committed
  a294249

  Copy full SHA for a294249

• Invert logic

  westonruter

  committed
  80fb303

  Copy full SHA for 80fb303

• Improve test coverage of sanitizers and theme-support

  westonruter

  committed
  da5a3ff

  Copy full SHA for da5a3ff

• Add tests for remove_invalid_attribute

  westonruter

  committed
  b035e62

  Copy full SHA for b035e62

• Rewrite comments sanitizer tests

  westonruter

  committed
  a5e94b0

  Copy full SHA for a5e94b0

• Add tests for AMP_Script_Sanitizer

  westonruter

  committed
  8349c56

  Copy full SHA for 8349c56

• Add coverage for replace_node_with_children_validation_errors

  westonruter

  committed
  b512764

  Copy full SHA for b512764

• Eliminate nodes_to_keep in favor of using data-amp-unvalidated-tag attribute

  westonruter

  committed
  26d8606

  Copy full SHA for 26d8606

• Add tests for SandboxingLevels minus the add_hooks method

  westonruter

  committed
  8a1d3b5

  Copy full SHA for 8a1d3b5

• Add tests for SandboxingLevels::add_hooks()

  westonruter

  committed
  669da7e

  Copy full SHA for 669da7e

• Add tests for ValidationExemption

  westonruter

  committed
  346867c

  Copy full SHA for 346867c

• Fix test failures

  westonruter

  committed
  13ad904

  Copy full SHA for 13ad904

• Remove obsolete arg from test

  westonruter

  committed
  0a24032

  Copy full SHA for 0a24032

• Improve conditionality of including comment-reply

  westonruter

  committed
  925cbe7

  Copy full SHA for 925cbe7

• Tidy up script and comments sanitier changes

  westonruter

  committed
  8aab322

  Copy full SHA for 8aab322

• Update testing logic for changes in AMP_Comments_Sanitizer

  westonruter

  committed
  74b49a0

  Copy full SHA for 74b49a0

• Remove dead code and improve structure of comments sanitizer

  westonruter

  committed
  6bf5c78

  Copy full SHA for 6bf5c78

• Only normalize form targets on non-native forms; fix form tests

  westonruter

  committed
  54f57b9

  Copy full SHA for 54f57b9

• Use native forms when PX-verified scripts are found as well as AMP-unvalidated ones

  westonruter

  committed
  2ac066c

  Copy full SHA for 2ac066c

• Fix SandboxingLevelsTest and Test_AMP_Theme_Support

  westonruter

  committed
  fc63b82

  Copy full SHA for fc63b82

• Fix test_add_amp_live_list_comment_attributes for WP<5.2

  westonruter

  committed
  8be564f

  Copy full SHA for 8be564f

Commits on Sep 21, 2021

• Merge branch 'develop' of github.com:ampproject/amp-wp into add/sandboxing-levels

  Show description for 4a81cc8
  westonruter

  committed
  4a81cc8

  Copy full SHA for 4a81cc8

• Improve conditions for DOM objects

  Show description for a75b23d
  

  westonruter

  and

  schlessera

  authored
  a75b23d

  Copy full SHA for a75b23d

• Optimize conditionals in ValidationExemption

  westonruter

  committed
  96a4c11

  Copy full SHA for 96a4c11

• Add note about temporalness of filter

  westonruter

  committed
  826a564

  Copy full SHA for 826a564

• Rename SandboxingLevels to just Sandboxing

  westonruter

  committed
  8e137db

  Copy full SHA for 8e137db

• Remove redundant SANDBOXING prefix

  westonruter

  committed
  a561a2c

  Copy full SHA for a561a2c

• Annotate native markup as PX-verified not AMP-unvalidated

  westonruter

  committed
  dc2f88f

  Copy full SHA for dc2f88f

• Merge branch 'develop' of github.com:ampproject/amp-wp into add/sandboxing-levels

  Show description for 989af80
  westonruter

  committed
  989af80

  Copy full SHA for 989af80

Commits on Sep 22, 2021

• Add PX-verified and AMP-unvalidated attributes based on !important qualifiers and kept errors

  westonruter

  committed
  19c3c12

  Copy full SHA for 19c3c12

Commits on Sep 28, 2021

• Fix covers tag

  Show description for 98025a7
  

  westonruter

  and

  pierlon

  authored
  98025a7

  Copy full SHA for 98025a7

• Remove needless looping over sanitizers

  Show description for a73b84a
  

  westonruter

  and

  pierlon

  authored
  a73b84a

  Copy full SHA for a73b84a

• Bump parsed stylesheet cache group

  westonruter

  committed
  f99c56b

  Copy full SHA for f99c56b

• Add allow_excessive_css argument to AMP_Style_Sanitizer

  westonruter

  committed
  5961514

  Copy full SHA for 5961514

• Remove make_http_url_schemeless dead code

  westonruter

  committed
  78684ae

  Copy full SHA for 78684ae

Commits on Sep 30, 2021

• Reset changes before calling tearDown

  Show description for d651b45
  

  westonruter

  and

  pierlon

  authored
  d651b45

  Copy full SHA for d651b45

• Merge branch 'develop' of github.com:ampproject/amp-wp into add/sandboxing-levels

  Show description for e1c7570
  westonruter

  committed
  e1c7570

  Copy full SHA for e1c7570

• Use xpath instead of getElementById

  westonruter

  committed
  fd32008

  Copy full SHA for fd32008

• Add covers phpdoc tag to test_ampify_threaded_comments

  westonruter

  committed
  4e5e4fd

  Copy full SHA for 4e5e4fd

• Improve test coverage for AMP_Script_Sanitizer

  westonruter

  committed
  6c22fcd

  Copy full SHA for 6c22fcd

• Fix sanitization of keyframes outside of style[amp-keyframes]

  westonruter

  committed
  7ac935a

  Copy full SHA for 7ac935a

• Improve test coverage for ValidationExemption

  westonruter

  committed
  d604e28

  Copy full SHA for d604e28

• Merge branch 'develop' of github.com:ampproject/amp-wp into add/sandboxing-levels

  Show description for 219c4f7
  westonruter

  committed
  219c4f7

  Copy full SHA for 219c4f7

• Add test coverage for allowlisted properties in CSS declaration block

  westonruter

  committed
  9fbb876

  Copy full SHA for 9fbb876

• Add test coverage for invalid at-rule inside keyframes

  westonruter

  committed
  1a0454b

  Copy full SHA for 1a0454b

• Work around coverage decrease by adding covers tags for private methods in img sanitizer

  westonruter

  committed
  85ace0f

  Copy full SHA for 85ace0f

• Remove empty style attributes add style sanitizer test coverage

  westonruter

  committed
  707550a

  Copy full SHA for 707550a

• Add additional covers tags for private methods in audio, iframe, and video sanitizers

  westonruter

  committed
  e1c81c2

  Copy full SHA for e1c81c2

Commits on Oct 1, 2021

• Add test coverage for AMP_Validation_Error_Taxonomy::get_error_title_from_code()

  westonruter

  committed
  5b60903

  Copy full SHA for 5b60903

• Add yet more covers tags for private methods in style sanitizer

  westonruter

  committed
  9b304e1

  Copy full SHA for 9b304e1

• Opt to disable stylesheet processing when in level 1

  westonruter

  committed
  c1dde99

  Copy full SHA for c1dde99

Commits on Oct 2, 2021

• Make ValidationExemption more DRY and performant

  westonruter

  committed
  bd54a6f

  Copy full SHA for bd54a6f

Commits on Oct 4, 2021

• Add effective sandboxing level to meta generator and admin bar

  westonruter

  committed
  4cdaabb

  Copy full SHA for 4cdaabb

Commits on Oct 13, 2021

• Fix grammar typos in comment

  Show description for 502873c
  

  westonruter

  and

  pierlon

  authored
  502873c

  Copy full SHA for 502873c

• Merge branch 'develop' of github.com:ampproject/amp-wp into add/sandboxing-levels

  Show description for faaf295
  westonruter

  committed
  faaf295

  Copy full SHA for faaf295