Skip to content

Commit e9b0460

Browse files
westonruterwestonruter
committed
Add crossorigin=anonymous to links and scripts
1 parent 1e16659 commit e9b0460

File tree

6 files changed

+45
-32
lines changed

6 files changed

+45
-32
lines changed

‎includes/amp-helper-functions.php‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -448,7 +448,8 @@ function amp_register_default_scripts( $wp_scripts ) {
448448
$handle,
449449
'amp_script_attributes',
450450
[
451-
'async' => true,
451+
'async' => true,
452+
'crossorigin' => 'anonymous',
452453
]
453454
);
454455

@@ -464,7 +465,8 @@ function amp_register_default_scripts( $wp_scripts ) {
464465
$handle,
465466
'amp_script_attributes',
466467
[
467-
'async' => true,
468+
'async' => true,
469+
'crossorigin' => 'anonymous',
468470
]
469471
);
470472

@@ -553,9 +555,11 @@ function amp_filter_script_loader_tag( $tag, $handle ) {
553555
/*
554556
* All scripts from AMP CDN should be loaded async.
555557
* See <https://www.ampproject.org/docs/integration/pwa-amp/amp-in-pwa#include-"shadow-amp"-in-your-progressive-web-app>.
558+
* For crossorigin=anonymous, see <https://github.com/ampproject/amphtml/issues/24731>.
556559
*/
557560
$attributes = [
558-
'async' => true,
561+
'async' => true,
562+
'crossorigin' => 'anonymous',
559563
];
560564

561565
// Add custom-template and custom-element attributes. All component scripts look like https://cdn.ampproject.org/v0/:name-:version.js.

‎includes/class-amp-theme-support.php‎

Lines changed: 15 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1642,8 +1642,9 @@ public static function ensure_required_markup( Document $dom, $script_handles =
16421642
$dom,
16431643
Tag::LINK,
16441644
[
1645-
Attribute::REL => Attribute::REL_PRECONNECT,
1646-
Attribute::HREF => 'https://cdn.ampproject.org',
1645+
Attribute::REL => Attribute::REL_PRECONNECT,
1646+
Attribute::HREF => 'https://cdn.ampproject.org',
1647+
Attribute::CROSSORIGIN => Attribute::CROSSORIGIN_ANONYMOUS,
16471648
]
16481649
),
16491650
],
@@ -1712,8 +1713,9 @@ public static function ensure_required_markup( Document $dom, $script_handles =
17121713
continue;
17131714
}
17141715
$attrs = [
1715-
Attribute::SRC => wp_scripts()->registered[ $missing_script_handle ]->src,
1716-
Attribute::ASYNC => '',
1716+
Attribute::SRC => wp_scripts()->registered[ $missing_script_handle ]->src,
1717+
Attribute::ASYNC => '',
1718+
Attribute::CROSSORIGIN => Attribute::CROSSORIGIN_ANONYMOUS,
17171719
];
17181720
if ( Extension::MUSTACHE === $missing_script_handle ) {
17191721
$attrs[ Attribute::CUSTOM_TEMPLATE ] = $missing_script_handle;
@@ -1752,9 +1754,10 @@ public static function ensure_required_markup( Document $dom, $script_handles =
17521754
$dom,
17531755
Tag::LINK,
17541756
[
1755-
Attribute::REL => Attribute::REL_PRELOAD,
1756-
'as' => Tag::SCRIPT,
1757-
Attribute::HREF => $runtime_src,
1757+
Attribute::REL => Attribute::REL_PRELOAD,
1758+
Attribute::AS => Tag::SCRIPT,
1759+
Attribute::HREF => $runtime_src,
1760+
Attribute::CROSSORIGIN => Attribute::CROSSORIGIN_ANONYMOUS,
17581761
]
17591762
);
17601763

@@ -1771,9 +1774,10 @@ public static function ensure_required_markup( Document $dom, $script_handles =
17711774
$dom,
17721775
Tag::LINK,
17731776
[
1774-
Attribute::REL => Attribute::REL_PRELOAD,
1775-
'as' => Tag::SCRIPT,
1776-
Attribute::HREF => $amp_scripts[ $script_handle ]->getAttribute( Attribute::SRC ),
1777+
Attribute::REL => Attribute::REL_PRELOAD,
1778+
Attribute::AS => Tag::SCRIPT,
1779+
Attribute::HREF => $amp_scripts[ $script_handle ]->getAttribute( Attribute::SRC ),
1780+
Attribute::CROSSORIGIN => Attribute::CROSSORIGIN_ANONYMOUS,
17771781
]
17781782
);
17791783
}
@@ -1807,6 +1811,7 @@ public static function ensure_required_markup( Document $dom, $script_handles =
18071811
$script = $dom->createElement( Tag::SCRIPT );
18081812
$script->setAttribute( Attribute::ASYNC, '' );
18091813
$script->setAttribute( Attribute::SRC, $runtime_src );
1814+
$script->setAttribute( Attribute::CROSSORIGIN, Attribute::CROSSORIGIN_ANONYMOUS );
18101815
$ordered_scripts[ Amp::RUNTIME ] = $script;
18111816
}
18121817

‎includes/sanitizers/class-amp-style-sanitizer.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1275,7 +1275,7 @@ private function process_link_element( DOMElement $element ) {
12751275
[
12761276
'rel' => 'preconnect',
12771277
'href' => 'https://fonts.gstatic.com/',
1278-
'crossorigin' => '',
1278+
'crossorigin' => 'anonymous',
12791279
]
12801280
);
12811281
$this->dom->head->insertBefore( $link ); // Note that \AMP_Theme_Support::ensure_required_markup() will put this in the optimal order.

‎lib/common/src/Attribute.php‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,11 +27,13 @@ interface Attribute
2727
const AMP_RUNTIME = 'amp-runtime';
2828
const AMP_SCRIPT_SRC = 'amp-script-src';
2929
const ARIA_HIDDEN = 'aria-hidden';
30+
const AS = 'as';
3031
const ASYNC = 'async';
3132
const AUTOPLAY = 'autoplay';
3233
const CHARSET = 'charset';
3334
const CLASS_ = 'class'; // Underscore needed because 'class' is a PHP keyword.
3435
const CONTENT = 'content';
36+
const CROSSORIGIN = 'crossorigin';
3537
const CUSTOM_ELEMENT = 'custom-element';
3638
const CUSTOM_TEMPLATE = 'custom-template';
3739
const HEIGHT = 'height';
@@ -71,4 +73,6 @@ interface Attribute
7173
const REL_PRELOAD = 'preload';
7274
const REL_PRERENDER = 'prerender';
7375
const REL_STYLESHEET = 'stylesheet';
76+
77+
const CROSSORIGIN_ANONYMOUS = 'anonymous';
7478
}

‎tests/php/test-amp-helper-functions.php‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -723,9 +723,9 @@ public function test_script_registering() {
723723

724724
$output = get_echo( 'wp_print_scripts' );
725725

726-
$this->assertContains( '<script type=\'text/javascript\' src=\'https://cdn.ampproject.org/v0.js\' async></script>', $output ); // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedScript
727-
$this->assertContains( '<script type=\'text/javascript\' src=\'https://cdn.ampproject.org/v0/amp-mathml-0.1.js\' async custom-element="amp-mathml"></script>', $output ); // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedScript
728-
$this->assertContains( '<script type=\'text/javascript\' src=\'https://cdn.ampproject.org/v0/amp-mustache-latest.js\' async custom-template="amp-mustache"></script>', $output ); // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedScript
726+
$this->assertContains( '<script type=\'text/javascript\' src=\'https://cdn.ampproject.org/v0.js\' async crossorigin="anonymous"></script>', $output ); // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedScript
727+
$this->assertContains( '<script type=\'text/javascript\' src=\'https://cdn.ampproject.org/v0/amp-mathml-0.1.js\' async crossorigin="anonymous" custom-element="amp-mathml"></script>', $output ); // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedScript
728+
$this->assertContains( '<script type=\'text/javascript\' src=\'https://cdn.ampproject.org/v0/amp-mustache-latest.js\' async crossorigin="anonymous" custom-template="amp-mustache"></script>', $output ); // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedScript
729729

730730
// Try rendering via amp_render_scripts() instead of amp_render_scripts(), which is how component scripts get added normally.
731731
$output = amp_render_scripts(
@@ -736,13 +736,13 @@ public function test_script_registering() {
736736
]
737737
);
738738
$this->assertNotContains( 'amp-mathml', $output, 'The amp-mathml component was already printed above.' );
739-
$this->assertContains( '<script type=\'text/javascript\' src=\'https://cdn.ampproject.org/v0/amp-mustache-2.0.js\' async custom-element="amp-carousel"></script>', $output ); // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedScript
740-
$this->assertContains( '<script type=\'text/javascript\' src=\'https://cdn.ampproject.org/v0/amp-accordion-0.1.js\' async custom-element="amp-accordion"></script>', $output ); // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedScript
739+
$this->assertContains( '<script type=\'text/javascript\' src=\'https://cdn.ampproject.org/v0/amp-mustache-2.0.js\' async crossorigin="anonymous" custom-element="amp-carousel"></script>', $output ); // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedScript
740+
$this->assertContains( '<script type=\'text/javascript\' src=\'https://cdn.ampproject.org/v0/amp-accordion-0.1.js\' async crossorigin="anonymous" custom-element="amp-accordion"></script>', $output ); // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedScript
741741

742742
// Try some experimental component to ensure expected script attributes are added.
743743
wp_register_script( 'amp-foo', 'https://cdn.ampproject.org/v0/amp-foo-0.1.js', [ 'amp-runtime' ], null ); // phpcs:ignore WordPress.WP.EnqueuedResourceParameters.NotInFooter, WordPress.WP.EnqueuedResourceParameters.MissingVersion
744744
$output = get_echo( 'wp_print_scripts', [ 'amp-foo' ] );
745-
$this->assertContains( '<script type=\'text/javascript\' src=\'https://cdn.ampproject.org/v0/amp-foo-0.1.js\' async custom-element="amp-foo"></script>', $output ); // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedScript
745+
$this->assertContains( '<script type=\'text/javascript\' src=\'https://cdn.ampproject.org/v0/amp-foo-0.1.js\' async crossorigin="anonymous" custom-element="amp-foo"></script>', $output ); // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedScript
746746
}
747747

748748
/**

‎tests/php/test-class-amp-theme-support.php‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -625,7 +625,7 @@ public function test_validate_non_amp_theme() {
625625
$this->assertContains( '<meta name="viewport" content="maximum-scale=1.0,width=device-width">', $sanitized_html );
626626

627627
// MathML script was added.
628-
$this->assertContains( '<script type="text/javascript" src="https://cdn.ampproject.org/v0/amp-mathml-0.1.js" async custom-element="amp-mathml"></script>', $sanitized_html ); // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedScript
628+
$this->assertContains( '<script type="text/javascript" src="https://cdn.ampproject.org/v0/amp-mathml-0.1.js" async crossorigin="anonymous" custom-element="amp-mathml"></script>', $sanitized_html ); // phpcs:ignore WordPress.WP.EnqueuedResources.NonEnqueuedScript
629629
}
630630

631631
/**
@@ -2014,21 +2014,21 @@ static function ( $url ) {
20142014
'<meta name="viewport" content="width=device-width">',
20152015
'<meta name="generator" content="AMP Plugin',
20162016
'<title>',
2017-
'<link rel="preconnect" href="https://cdn.ampproject.org">',
2018-
'<link rel="preconnect" href="https://fonts.gstatic.com/" crossorigin="">',
2017+
'<link rel="preconnect" href="https://cdn.ampproject.org" crossorigin="anonymous">',
2018+
'<link rel="preconnect" href="https://fonts.gstatic.com/" crossorigin="anonymous">',
20192019
'<link rel="dns-prefetch" href="//cdn.ampproject.org">',
2020-
'<link rel="preload" as="script" href="https://cdn.ampproject.org/v0.js">',
2021-
'<link rel="preload" as="script" href="https://cdn.ampproject.org/v0/amp-dynamic-css-classes-0.1.js">',
2022-
'<link rel="preload" as="script" href="https://cdn.ampproject.org/v0/amp-experiment-1.0.js">',
2023-
'<script type="text/javascript" src="https://cdn.ampproject.org/v0.js" async></script>',
2020+
'<link rel="preload" as="script" href="https://cdn.ampproject.org/v0.js" crossorigin="anonymous">',
2021+
'<link rel="preload" as="script" href="https://cdn.ampproject.org/v0/amp-dynamic-css-classes-0.1.js" crossorigin="anonymous">',
2022+
'<link rel="preload" as="script" href="https://cdn.ampproject.org/v0/amp-experiment-1.0.js" crossorigin="anonymous">',
2023+
'<script type="text/javascript" src="https://cdn.ampproject.org/v0.js" async crossorigin="anonymous"></script>',
20242024

20252025
'<script async custom-element="amp-dynamic-css-classes" src="https://cdn.ampproject.org/v0/amp-dynamic-css-classes-0.1.js"></script>',
2026-
'<script src="https://cdn.ampproject.org/v0/amp-experiment-1.0.js" async="" custom-element="amp-experiment"></script>',
2026+
'<script src="https://cdn.ampproject.org/v0/amp-experiment-1.0.js" async="" crossorigin="anonymous" custom-element="amp-experiment"></script>',
20272027

2028-
'#<script( type=[\'"]text/javascript[\'"])? src=[\'"]https\://cdn\.ampproject\.org/v0/amp-ad-0\.1\.js[\'"] async(=[\'"][\'"])? custom-element=[\'"]amp-ad[\'"]>\s*</script>#s',
2029-
'#<script src=[\'"]https\://cdn\.ampproject\.org/v0/amp-audio-0\.1\.js[\'"] async(=[\'"][\'"])? custom-element=[\'"]amp-audio[\'"]>\s*</script>#s',
2030-
'<script type="text/javascript" src="https://cdn.ampproject.org/v0/amp-list-0.1.js" async custom-element="amp-list"></script>',
2031-
'<script type="text/javascript" src="https://cdn.ampproject.org/v0/amp-mathml-0.1.js" async custom-element="amp-mathml"></script>',
2028+
'#<script( type=[\'"]text/javascript[\'"])? src=[\'"]https\://cdn\.ampproject\.org/v0/amp-ad-0\.1\.js[\'"] async(=[\'"][\'"])? crossorigin=[\'"]anonymous[\'"] custom-element=[\'"]amp-ad[\'"]>\s*</script>#s',
2029+
'#<script src=[\'"]https\://cdn\.ampproject\.org/v0/amp-audio-0\.1\.js[\'"] async(=[\'"][\'"])? crossorigin=[\'"]anonymous[\'"] custom-element=[\'"]amp-audio[\'"]>\s*</script>#s',
2030+
'<script type="text/javascript" src="https://cdn.ampproject.org/v0/amp-list-0.1.js" async crossorigin="anonymous" custom-element="amp-list"></script>',
2031+
'<script type="text/javascript" src="https://cdn.ampproject.org/v0/amp-mathml-0.1.js" async crossorigin="anonymous" custom-element="amp-mathml"></script>',
20322032

20332033
'<link rel="icon" href="https://example.org/favicon.png" sizes="32x32">',
20342034
'<link rel="icon" href="https://example.org/favicon.png" sizes="192x192">',

0 commit comments

Comments
 (0)