Skip to content

Commit 4600464

Browse files
westonruterwestonruter
committed
Add crossorigin=anonymous to links and scripts
1 parent cf8e01e commit 4600464

File tree

6 files changed

+45
-32
lines changed

6 files changed

+45
-32
lines changed

‎includes/amp-helper-functions.php‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -448,7 +448,8 @@ function amp_register_default_scripts( $wp_scripts ) {
448448
$handle,
449449
'amp_script_attributes',
450450
[
451-
'async' => true,
451+
'async' => true,
452+
'crossorigin' => 'anonymous',
452453
]
453454
);
454455

@@ -464,7 +465,8 @@ function amp_register_default_scripts( $wp_scripts ) {
464465
$handle,
465466
'amp_script_attributes',
466467
[
467-
'async' => true,
468+
'async' => true,
469+
'crossorigin' => 'anonymous',
468470
]
469471
);
470472

@@ -553,9 +555,11 @@ function amp_filter_script_loader_tag( $tag, $handle ) {
553555
/*
554556
* All scripts from AMP CDN should be loaded async.
555557
* See <https://www.ampproject.org/docs/integration/pwa-amp/amp-in-pwa#include-"shadow-amp"-in-your-progressive-web-app>.
558+
* For crossorigin=anonymous, see <https://github.com/ampproject/amphtml/issues/24731>.
556559
*/
557560
$attributes = [
558-
'async' => true,
561+
'async' => true,
562+
'crossorigin' => 'anonymous',
559563
];
560564

561565
// Add custom-template and custom-element attributes. All component scripts look like https://cdn.ampproject.org/v0/:name-:version.js.

‎includes/class-amp-theme-support.php‎

Lines changed: 15 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1626,8 +1626,9 @@ public static function ensure_required_markup( Document $dom, $script_handles =
16261626
$dom,
16271627
Tag::LINK,
16281628
[
1629-
Attribute::REL => Attribute::REL_PRECONNECT,
1630-
Attribute::HREF => 'https://cdn.ampproject.org',
1629+
Attribute::REL => Attribute::REL_PRECONNECT,
1630+
Attribute::HREF => 'https://cdn.ampproject.org',
1631+
Attribute::CROSSORIGIN => Attribute::CROSSORIGIN_ANONYMOUS,
16311632
]
16321633
),
16331634
],
@@ -1696,8 +1697,9 @@ public static function ensure_required_markup( Document $dom, $script_handles =
16961697
continue;
16971698
}
16981699
$attrs = [
1699-
Attribute::SRC => wp_scripts()->registered[ $missing_script_handle ]->src,
1700-
Attribute::ASYNC => '',
1700+
Attribute::SRC => wp_scripts()->registered[ $missing_script_handle ]->src,
1701+
Attribute::ASYNC => '',
1702+
Attribute::CROSSORIGIN => Attribute::CROSSORIGIN_ANONYMOUS,
17011703
];
17021704
if ( Extension::MUSTACHE === $missing_script_handle ) {
17031705
$attrs[ Attribute::CUSTOM_TEMPLATE ] = $missing_script_handle;
@@ -1736,9 +1738,10 @@ public static function ensure_required_markup( Document $dom, $script_handles =
17361738
$dom,
17371739
Tag::LINK,
17381740
[
1739-
Attribute::REL => Attribute::REL_PRELOAD,
1740-
'as' => Tag::SCRIPT,
1741-
Attribute::HREF => $runtime_src,
1741+
Attribute::REL => Attribute::REL_PRELOAD,
1742+
Attribute::AS => Tag::SCRIPT,
1743+
Attribute::HREF => $runtime_src,
1744+
Attribute::CROSSORIGIN => Attribute::CROSSORIGIN_ANONYMOUS,
17421745
]
17431746
);
17441747

@@ -1755,9 +1758,10 @@ public static function ensure_required_markup( Document $dom, $script_handles =
17551758
$dom,
17561759
Tag::LINK,
17571760
[
1758-
Attribute::REL => Attribute::REL_PRELOAD,
1759-
'as' => Tag::SCRIPT,
1760-
Attribute::HREF => $amp_scripts[ $script_handle ]->getAttribute( Attribute::SRC ),
1761+
Attribute::REL => Attribute::REL_PRELOAD,
1762+
Attribute::AS => Tag::SCRIPT,
1763+
Attribute::HREF => $amp_scripts[ $script_handle ]->getAttribute( Attribute::SRC ),
1764+
Attribute::CROSSORIGIN => Attribute::CROSSORIGIN_ANONYMOUS,
17611765
]
17621766
);
17631767
}
@@ -1791,6 +1795,7 @@ public static function ensure_required_markup( Document $dom, $script_handles =
17911795
$script = $dom->createElement( Tag::SCRIPT );
17921796
$script->setAttribute( Attribute::ASYNC, '' );
17931797
$script->setAttribute( Attribute::SRC, $runtime_src );
1798+
$script->setAttribute( Attribute::CROSSORIGIN, Attribute::CROSSORIGIN_ANONYMOUS );
17941799
$ordered_scripts[ Amp::RUNTIME ] = $script;
17951800
}
17961801

‎includes/sanitizers/class-amp-style-sanitizer.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1304,7 +1304,7 @@ private function process_link_element( DOMElement $element ) {
13041304
[
13051305
'rel' => 'preconnect',
13061306
'href' => 'https://fonts.gstatic.com/',
1307-
'crossorigin' => '',
1307+
'crossorigin' => 'anonymous',
13081308
]
13091309
);
13101310
$this->dom->head->insertBefore( $link ); // Note that \AMP_Theme_Support::ensure_required_markup() will put this in the optimal order.

‎lib/common/src/Attribute.php‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,11 +27,13 @@ interface Attribute
2727
const AMP_RUNTIME = 'amp-runtime';
2828
const AMP_SCRIPT_SRC = 'amp-script-src';
2929
const ARIA_HIDDEN = 'aria-hidden';
30+
const AS = 'as';
3031
const ASYNC = 'async';
3132
const AUTOPLAY = 'autoplay';
3233
const CHARSET = 'charset';
3334
const CLASS_ = 'class'; // Underscore needed because 'class' is a PHP keyword.
3435
const CONTENT = 'content';
36+
const CROSSORIGIN = 'crossorigin';
3537
const CUSTOM_ELEMENT = 'custom-element';
3638
const CUSTOM_TEMPLATE = 'custom-template';
3739
const HEIGHT = 'height';
@@ -71,4 +73,6 @@ interface Attribute
7173
const REL_PRELOAD = 'preload';
7274
const REL_PRERENDER = 'prerender';
7375
const REL_STYLESHEET = 'stylesheet';
76+
77+
const CROSSORIGIN_ANONYMOUS = 'anonymous';
7478
}

‎tests/php/test-amp-helper-functions.php‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -723,9 +723,9 @@ public function test_script_registering() {
723723

724724
$output = get_echo( 'wp_print_scripts' );
725725

726-
$this->assertContains( '<script type=\'text/javascript\' src=\'https://cdn.ampproject.org/v0.js\' async></script>', $output ); // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedScript
727-
$this->assertContains( '<script type=\'text/javascript\' src=\'https://cdn.ampproject.org/v0/amp-mathml-0.1.js\' async custom-element="amp-mathml"></script>', $output ); // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedScript
728-
$this->assertContains( '<script type=\'text/javascript\' src=\'https://cdn.ampproject.org/v0/amp-mustache-latest.js\' async custom-template="amp-mustache"></script>', $output ); // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedScript
726+
$this->assertContains( '<script type=\'text/javascript\' src=\'https://cdn.ampproject.org/v0.js\' async crossorigin="anonymous"></script>', $output ); // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedScript
727+
$this->assertContains( '<script type=\'text/javascript\' src=\'https://cdn.ampproject.org/v0/amp-mathml-0.1.js\' async crossorigin="anonymous" custom-element="amp-mathml"></script>', $output ); // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedScript
728+
$this->assertContains( '<script type=\'text/javascript\' src=\'https://cdn.ampproject.org/v0/amp-mustache-latest.js\' async crossorigin="anonymous" custom-template="amp-mustache"></script>', $output ); // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedScript
729729

730730
// Try rendering via amp_render_scripts() instead of amp_render_scripts(), which is how component scripts get added normally.
731731
$output = amp_render_scripts(
@@ -736,13 +736,13 @@ public function test_script_registering() {
736736
]
737737
);
738738
$this->assertNotContains( 'amp-mathml', $output, 'The amp-mathml component was already printed above.' );
739-
$this->assertContains( '<script type=\'text/javascript\' src=\'https://cdn.ampproject.org/v0/amp-mustache-2.0.js\' async custom-element="amp-carousel"></script>', $output ); // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedScript
740-
$this->assertContains( '<script type=\'text/javascript\' src=\'https://cdn.ampproject.org/v0/amp-accordion-0.1.js\' async custom-element="amp-accordion"></script>', $output ); // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedScript
739+
$this->assertContains( '<script type=\'text/javascript\' src=\'https://cdn.ampproject.org/v0/amp-mustache-2.0.js\' async crossorigin="anonymous" custom-element="amp-carousel"></script>', $output ); // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedScript
740+
$this->assertContains( '<script type=\'text/javascript\' src=\'https://cdn.ampproject.org/v0/amp-accordion-0.1.js\' async crossorigin="anonymous" custom-element="amp-accordion"></script>', $output ); // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedScript
741741

742742
// Try some experimental component to ensure expected script attributes are added.
743743
wp_register_script( 'amp-foo', 'https://cdn.ampproject.org/v0/amp-foo-0.1.js', [ 'amp-runtime' ], null ); // phpcs:ignore WordPress.WP.EnqueuedResourceParameters.NotInFooter, WordPress.WP.EnqueuedResourceParameters.MissingVersion
744744
$output = get_echo( 'wp_print_scripts', [ 'amp-foo' ] );
745-
$this->assertContains( '<script type=\'text/javascript\' src=\'https://cdn.ampproject.org/v0/amp-foo-0.1.js\' async custom-element="amp-foo"></script>', $output ); // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedScript
745+
$this->assertContains( '<script type=\'text/javascript\' src=\'https://cdn.ampproject.org/v0/amp-foo-0.1.js\' async crossorigin="anonymous" custom-element="amp-foo"></script>', $output ); // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedScript
746746
}
747747

748748
/**

‎tests/php/test-class-amp-theme-support.php‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -625,7 +625,7 @@ public function test_validate_non_amp_theme() {
625625
$this->assertContains( '<meta name="viewport" content="maximum-scale=1.0,width=device-width">', $sanitized_html );
626626

627627
// MathML script was added.
628-
$this->assertContains( '<script type="text/javascript" src="https://cdn.ampproject.org/v0/amp-mathml-0.1.js" async custom-element="amp-mathml"></script>', $sanitized_html ); // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedScript
628+
$this->assertContains( '<script type="text/javascript" src="https://cdn.ampproject.org/v0/amp-mathml-0.1.js" async crossorigin="anonymous" custom-element="amp-mathml"></script>', $sanitized_html ); // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedScript
629629
}
630630

631631
/**
@@ -1981,21 +1981,21 @@ static function ( $url ) {
19811981
'<meta name="viewport" content="width=device-width">',
19821982
'<meta name="generator" content="AMP Plugin',
19831983
'<title>',
1984-
'<link rel="preconnect" href="https://cdn.ampproject.org">',
1985-
'<link rel="preconnect" href="https://fonts.gstatic.com/" crossorigin="">',
1984+
'<link rel="preconnect" href="https://cdn.ampproject.org" crossorigin="anonymous">',
1985+
'<link rel="preconnect" href="https://fonts.gstatic.com/" crossorigin="anonymous">',
19861986
'<link rel="dns-prefetch" href="//cdn.ampproject.org">',
1987-
'<link rel="preload" as="script" href="https://cdn.ampproject.org/v0.js">',
1988-
'<link rel="preload" as="script" href="https://cdn.ampproject.org/v0/amp-dynamic-css-classes-0.1.js">',
1989-
'<link rel="preload" as="script" href="https://cdn.ampproject.org/v0/amp-experiment-1.0.js">',
1990-
'<script type="text/javascript" src="https://cdn.ampproject.org/v0.js" async></script>',
1987+
'<link rel="preload" as="script" href="https://cdn.ampproject.org/v0.js" crossorigin="anonymous">',
1988+
'<link rel="preload" as="script" href="https://cdn.ampproject.org/v0/amp-dynamic-css-classes-0.1.js" crossorigin="anonymous">',
1989+
'<link rel="preload" as="script" href="https://cdn.ampproject.org/v0/amp-experiment-1.0.js" crossorigin="anonymous">',
1990+
'<script type="text/javascript" src="https://cdn.ampproject.org/v0.js" async crossorigin="anonymous"></script>',
19911991

19921992
'<script async custom-element="amp-dynamic-css-classes" src="https://cdn.ampproject.org/v0/amp-dynamic-css-classes-0.1.js"></script>',
1993-
'<script src="https://cdn.ampproject.org/v0/amp-experiment-1.0.js" async="" custom-element="amp-experiment"></script>',
1993+
'<script src="https://cdn.ampproject.org/v0/amp-experiment-1.0.js" async="" crossorigin="anonymous" custom-element="amp-experiment"></script>',
19941994

1995-
'#<script( type=[\'"]text/javascript[\'"])? src=[\'"]https\://cdn\.ampproject\.org/v0/amp-ad-0\.1\.js[\'"] async(=[\'"][\'"])? custom-element=[\'"]amp-ad[\'"]>\s*</script>#s',
1996-
'#<script src=[\'"]https\://cdn\.ampproject\.org/v0/amp-audio-0\.1\.js[\'"] async(=[\'"][\'"])? custom-element=[\'"]amp-audio[\'"]>\s*</script>#s',
1997-
'<script type="text/javascript" src="https://cdn.ampproject.org/v0/amp-list-0.1.js" async custom-element="amp-list"></script>',
1998-
'<script type="text/javascript" src="https://cdn.ampproject.org/v0/amp-mathml-0.1.js" async custom-element="amp-mathml"></script>',
1995+
'#<script( type=[\'"]text/javascript[\'"])? src=[\'"]https\://cdn\.ampproject\.org/v0/amp-ad-0\.1\.js[\'"] async(=[\'"][\'"])? crossorigin=[\'"]anonymous[\'"] custom-element=[\'"]amp-ad[\'"]>\s*</script>#s',
1996+
'#<script src=[\'"]https\://cdn\.ampproject\.org/v0/amp-audio-0\.1\.js[\'"] async(=[\'"][\'"])? crossorigin=[\'"]anonymous[\'"] custom-element=[\'"]amp-audio[\'"]>\s*</script>#s',
1997+
'<script type="text/javascript" src="https://cdn.ampproject.org/v0/amp-list-0.1.js" async crossorigin="anonymous" custom-element="amp-list"></script>',
1998+
'<script type="text/javascript" src="https://cdn.ampproject.org/v0/amp-mathml-0.1.js" async crossorigin="anonymous" custom-element="amp-mathml"></script>',
19991999

20002000
'<link rel="icon" href="https://example.org/favicon.png" sizes="32x32">',
20012001
'<link rel="icon" href="https://example.org/favicon.png" sizes="192x192">',

0 commit comments

Comments
 (0)