From d8ab291274869bcc6be9874cb38435b41c11fcb4 Mon Sep 17 00:00:00 2001
From: Weston Ruter <westonruter@google.com>
Date: Mon, 7 Oct 2024 12:22:34 -0700
Subject: [PATCH] Add mandatory parent special case for amp-subscriptions

---
 .../class-amp-tag-and-attribute-sanitizer.php | 29 +++++++++++++++----
 .../php/test-tag-and-attribute-sanitizer.php  | 23 +++++++++++++++
 2 files changed, 47 insertions(+), 5 deletions(-)

diff --git a/includes/sanitizers/class-amp-tag-and-attribute-sanitizer.php b/includes/sanitizers/class-amp-tag-and-attribute-sanitizer.php
index eaddcb92e4e..097a8827ff4 100644
--- a/includes/sanitizers/class-amp-tag-and-attribute-sanitizer.php
+++ b/includes/sanitizers/class-amp-tag-and-attribute-sanitizer.php
@@ -991,11 +991,30 @@ private function get_json_error_code( $json_last_error ) {
 	 */
 	private function validate_tag_spec_for_node( DOMElement $node, $tag_spec ) {
 
-		if ( ! empty( $tag_spec[ AMP_Rule_Spec::MANDATORY_PARENT ] ) && ! $this->has_parent( $node, $tag_spec[ AMP_Rule_Spec::MANDATORY_PARENT ] ) ) {
-			return [
-				'code'                 => self::WRONG_PARENT_TAG,
-				'required_parent_name' => $tag_spec[ AMP_Rule_Spec::MANDATORY_PARENT ],
-			];
+		if ( ! empty( $tag_spec[ AMP_Rule_Spec::MANDATORY_PARENT ] ) ) {
+			$missing_required_parent = false;
+			if ( 'subscriptions-section content swg_amp_cache_nonce' === $tag_spec[ AMP_Rule_Spec::MANDATORY_PARENT ] ) {
+				// Special case for mandatory parent name which doesn't follow the pattern where mandatory_parent is just a tag name.
+				if ( ! (
+					$this->has_parent( $node, 'section' )
+					&&
+					$node->parentNode instanceof DOMElement
+					&&
+					$node->parentNode->getAttribute( 'subscriptions-section' ) === 'content'
+					&&
+					$node->parentNode->hasAttribute( 'swg_amp_cache_nonce' )
+				) ) {
+					$missing_required_parent = true;
+				}
+			} elseif ( ! $this->has_parent( $node, $tag_spec[ AMP_Rule_Spec::MANDATORY_PARENT ] ) ) {
+				$missing_required_parent = true;
+			}
+			if ( $missing_required_parent ) {
+				return [
+					'code'                 => self::WRONG_PARENT_TAG,
+					'required_parent_name' => $tag_spec[ AMP_Rule_Spec::MANDATORY_PARENT ],
+				];
+			}
 		}
 
 		// Extension scripts must be in the head. Note this currently never fails because all AMP scripts are moved to the head before sanitization.
diff --git a/tests/php/test-tag-and-attribute-sanitizer.php b/tests/php/test-tag-and-attribute-sanitizer.php
index 202777cb7f5..d358108564c 100644
--- a/tests/php/test-tag-and-attribute-sanitizer.php
+++ b/tests/php/test-tag-and-attribute-sanitizer.php
@@ -3268,6 +3268,29 @@ class="tiktok-embed"
 				null,
 				[ 'amp-wordpress-embed' ],
 			],
+
+			'subscriptions-section'                        => [
+				'
+				<section class="text" subscriptions-section="content" encrypted="" swg_amp_cache_nonce="">
+				    <script type="application/octet-stream" ciphertext="">
+				    </script>
+				  </section>
+				    <span swg_amp_cache_nonce="">
+				    </span>
+				  <section subscriptions-section="content">
+				    <p class="text">
+				      Lorem ipsum.
+				    </p>
+				  </section>
+				  <section subscriptions-section="content-not-granted">
+				    <p class="text">
+				      <strong>Subscribe for more.</strong>
+				    </p>
+				  </section>
+				',
+				null,
+				[ 'amp-subscriptions' ],
+			],
 		];
 	}