From 7b82404ddc98d0710e6e8f7d2bc5a2811e2de644 Mon Sep 17 00:00:00 2001 From: Weston Ruter Date: Mon, 23 Mar 2020 21:06:40 -0700 Subject: [PATCH] Restrict JSON validation to non-LD scripts --- .../class-amp-tag-and-attribute-sanitizer.php | 2 +- .../php/test-tag-and-attribute-sanitizer.php | 30 +++++++++++-------- 2 files changed, 19 insertions(+), 13 deletions(-) diff --git a/includes/sanitizers/class-amp-tag-and-attribute-sanitizer.php b/includes/sanitizers/class-amp-tag-and-attribute-sanitizer.php index f37429e403f..de12c30e68f 100644 --- a/includes/sanitizers/class-amp-tag-and-attribute-sanitizer.php +++ b/includes/sanitizers/class-amp-tag-and-attribute-sanitizer.php @@ -936,7 +936,7 @@ private function validate_cdata_for_node( DOMElement $element, $cdata_spec ) { } // When the CDATA is expected to be JSON, ensure it's valid JSON. - if ( 'script' === $element->nodeName && in_array( $element->getAttribute( 'type' ), [ 'application/json', 'application/ld+json' ], true ) ) { + if ( 'script' === $element->nodeName && 'application/json' === $element->getAttribute( 'type' ) ) { if ( '' === trim( $element->textContent ) ) { return [ 'code' => self::JSON_ERROR_EMPTY ]; } diff --git a/tests/php/test-tag-and-attribute-sanitizer.php b/tests/php/test-tag-and-attribute-sanitizer.php index e433786e517..732072658de 100644 --- a/tests/php/test-tag-and-attribute-sanitizer.php +++ b/tests/php/test-tag-and-attribute-sanitizer.php @@ -2893,29 +2893,35 @@ public function get_html_data() { [ AMP_Tag_And_Attribute_Sanitizer::INVALID_CDATA_HTML_COMMENTS ], ], 'cdata_malformed_json' => [ - '', - '', - [], + '', + '', + [ 'amp-ima-video' ], [ AMP_Tag_And_Attribute_Sanitizer::JSON_ERROR_SYNTAX ], ], 'cdata_malformed_json_with_emojis' => [ - '', - '', - [], + '', + '', + [ 'amp-ima-video' ], [ AMP_Tag_And_Attribute_Sanitizer::JSON_ERROR_SYNTAX ], ], 'cdata_malformed_utf8_json' => [ - sprintf( '', "\xFF" ), - '', - [], + sprintf( '', "\xFF" ), + '', + [ 'amp-ima-video' ], [ AMP_Tag_And_Attribute_Sanitizer::JSON_ERROR_UTF8 ], ], 'cdata_empty_json_considered_invalid' => [ - '', - '', - [], + '', + '', + [ 'amp-ima-video' ], [ AMP_Tag_And_Attribute_Sanitizer::JSON_ERROR_EMPTY ], ], + 'cdata_empty_json_not_considered_invalid' => [ + '', + null, + [], + [], + ], 'analytics_empty_json_considered_invalid' => [ '', '',