From ffcd1511af1e0f811bbc8dc38ec5460e3a4984b7 Mon Sep 17 00:00:00 2001 From: adamsilverstein Date: Wed, 18 Mar 2026 10:30:54 -0700 Subject: [PATCH 1/5] Remove IMG from crossorigin attribute injection Under Document-Isolation-Policy: isolate-and-credentialless, the browser handles cross-origin images in credentialless mode without needing explicit CORS headers. Adding crossorigin="anonymous" to img elements overrides this and breaks external images whose servers don't serve CORS headers (e.g. sidebar previews for external image URLs). Also removes imagesrcset handling from LINK elements for the same reason. See #64766. --- src/wp-includes/media.php | 9 +----- .../tests/media/wpCrossOriginIsolation.php | 29 ++++++++++++++++++- 2 files changed, 29 insertions(+), 9 deletions(-) diff --git a/src/wp-includes/media.php b/src/wp-includes/media.php index fd215c800f9dc..9bf36efae81f9 100644 --- a/src/wp-includes/media.php +++ b/src/wp-includes/media.php @@ -6558,14 +6558,7 @@ function wp_add_crossorigin_attributes( string $html ): string { // See https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/crossorigin. $cross_origin_tag_attributes = array( 'AUDIO' => array( 'src' => false ), - 'IMG' => array( - 'src' => false, - 'srcset' => true, - ), - 'LINK' => array( - 'href' => false, - 'imagesrcset' => true, - ), + 'LINK' => array( 'href' => false ), 'SCRIPT' => array( 'src' => false ), 'VIDEO' => array( 'src' => false, diff --git a/tests/phpunit/tests/media/wpCrossOriginIsolation.php b/tests/phpunit/tests/media/wpCrossOriginIsolation.php index 4fe5723bdc426..7b057253bf25d 100644 --- a/tests/phpunit/tests/media/wpCrossOriginIsolation.php +++ b/tests/phpunit/tests/media/wpCrossOriginIsolation.php @@ -202,7 +202,7 @@ public function test_output_buffer_adds_crossorigin_attributes() { ob_start(); wp_start_cross_origin_isolation_output_buffer(); - echo ''; + echo ''; // Flush the inner buffer to trigger the callback, sending processed output to the outer buffer. ob_end_flush(); @@ -210,4 +210,31 @@ public function test_output_buffer_adds_crossorigin_attributes() { $this->assertStringContainsString( 'crossorigin="anonymous"', $output ); } + + /** + * Images should not get crossorigin="anonymous" because under + * Document-Isolation-Policy: isolate-and-credentialless, the credentialless + * mode handles image loading without CORS headers. Adding the attribute + * would break external images that don't serve CORS headers. + * + * @ticket 64766 + * + * @runInSeparateProcess + * @preserveGlobalState disabled + */ + public function test_output_buffer_does_not_add_crossorigin_to_images() { + $_SERVER['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36'; + + // Start an outer buffer to capture the callback-processed output. + ob_start(); + + wp_start_cross_origin_isolation_output_buffer(); + echo ''; + + // Flush the inner buffer to trigger the callback, sending processed output to the outer buffer. + ob_end_flush(); + $output = ob_get_clean(); + + $this->assertStringNotContainsString( 'crossorigin="anonymous"', $output ); + } } From d033f2a2d1cb7824d7e4eb262da18ad32f68e4dd Mon Sep 17 00:00:00 2001 From: adamsilverstein Date: Wed, 18 Mar 2026 10:54:59 -0700 Subject: [PATCH 2/5] Expand crossorigin isolation test coverage Add tests for audio, video, link, source elements, srcset on images, imagesrcset on links, same-origin and relative URLs, existing crossorigin preservation, and mixed tags. --- .../tests/media/wpCrossOriginIsolation.php | 229 ++++++++++++++++++ 1 file changed, 229 insertions(+) diff --git a/tests/phpunit/tests/media/wpCrossOriginIsolation.php b/tests/phpunit/tests/media/wpCrossOriginIsolation.php index 7b057253bf25d..0fa96cdec8e0a 100644 --- a/tests/phpunit/tests/media/wpCrossOriginIsolation.php +++ b/tests/phpunit/tests/media/wpCrossOriginIsolation.php @@ -237,4 +237,233 @@ public function test_output_buffer_does_not_add_crossorigin_to_images() { $this->assertStringNotContainsString( 'crossorigin="anonymous"', $output ); } + + /** + * Images with srcset should also not get crossorigin="anonymous". + * + * @ticket 64766 + * + * @runInSeparateProcess + * @preserveGlobalState disabled + */ + public function test_output_buffer_does_not_add_crossorigin_to_images_with_srcset() { + $_SERVER['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36'; + + ob_start(); + + wp_start_cross_origin_isolation_output_buffer(); + echo ''; + + ob_end_flush(); + $output = ob_get_clean(); + + $this->assertStringNotContainsString( 'crossorigin="anonymous"', $output ); + } + + /** + * Audio elements with cross-origin sources should get crossorigin="anonymous". + * + * @ticket 64766 + * + * @runInSeparateProcess + * @preserveGlobalState disabled + */ + public function test_output_buffer_adds_crossorigin_to_audio() { + $_SERVER['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36'; + + ob_start(); + + wp_start_cross_origin_isolation_output_buffer(); + echo ''; + + ob_end_flush(); + $output = ob_get_clean(); + + $this->assertStringContainsString( 'crossorigin="anonymous"', $output ); + } + + /** + * Video elements with cross-origin sources should get crossorigin="anonymous". + * + * @ticket 64766 + * + * @runInSeparateProcess + * @preserveGlobalState disabled + */ + public function test_output_buffer_adds_crossorigin_to_video() { + $_SERVER['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36'; + + ob_start(); + + wp_start_cross_origin_isolation_output_buffer(); + echo ''; + + ob_end_flush(); + $output = ob_get_clean(); + + $this->assertStringContainsString( 'crossorigin="anonymous"', $output ); + } + + /** + * Link elements with cross-origin href should get crossorigin="anonymous". + * + * @ticket 64766 + * + * @runInSeparateProcess + * @preserveGlobalState disabled + */ + public function test_output_buffer_adds_crossorigin_to_link() { + $_SERVER['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36'; + + ob_start(); + + wp_start_cross_origin_isolation_output_buffer(); + echo ''; + + ob_end_flush(); + $output = ob_get_clean(); + + $this->assertStringContainsString( 'crossorigin="anonymous"', $output ); + } + + /** + * Link elements with imagesrcset should no longer trigger crossorigin="anonymous" + * since imagesrcset handling was removed along with IMG. + * + * @ticket 64766 + * + * @runInSeparateProcess + * @preserveGlobalState disabled + */ + public function test_output_buffer_does_not_add_crossorigin_to_link_with_imagesrcset_only() { + $_SERVER['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36'; + + ob_start(); + + wp_start_cross_origin_isolation_output_buffer(); + echo ''; + + ob_end_flush(); + $output = ob_get_clean(); + + $this->assertStringNotContainsString( 'crossorigin="anonymous"', $output, 'Link elements should not get crossorigin based on imagesrcset alone.' ); + } + + /** + * Same-origin URLs should not get crossorigin="anonymous". + * + * @ticket 64766 + * + * @runInSeparateProcess + * @preserveGlobalState disabled + */ + public function test_output_buffer_does_not_add_crossorigin_to_same_origin_script() { + $_SERVER['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36'; + + ob_start(); + + wp_start_cross_origin_isolation_output_buffer(); + echo ''; + + ob_end_flush(); + $output = ob_get_clean(); + + $this->assertStringNotContainsString( 'crossorigin="anonymous"', $output, 'Same-origin scripts should not get crossorigin attribute.' ); + } + + /** + * Relative URLs should not get crossorigin="anonymous". + * + * @ticket 64766 + * + * @runInSeparateProcess + * @preserveGlobalState disabled + */ + public function test_output_buffer_does_not_add_crossorigin_to_relative_urls() { + $_SERVER['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36'; + + ob_start(); + + wp_start_cross_origin_isolation_output_buffer(); + echo ''; + + ob_end_flush(); + $output = ob_get_clean(); + + $this->assertStringNotContainsString( 'crossorigin="anonymous"', $output, 'Relative URLs should not get crossorigin attribute.' ); + } + + /** + * Elements that already have a crossorigin attribute should not be modified. + * + * @ticket 64766 + * + * @runInSeparateProcess + * @preserveGlobalState disabled + */ + public function test_output_buffer_does_not_override_existing_crossorigin() { + $_SERVER['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36'; + + ob_start(); + + wp_start_cross_origin_isolation_output_buffer(); + echo ''; + + ob_end_flush(); + $output = ob_get_clean(); + + $this->assertStringContainsString( 'crossorigin="use-credentials"', $output, 'Existing crossorigin attribute should not be overridden.' ); + $this->assertStringNotContainsString( 'crossorigin="anonymous"', $output ); + } + + /** + * Source elements inside video/audio with cross-origin src should add + * crossorigin to the parent element. + * + * @ticket 64766 + * + * @runInSeparateProcess + * @preserveGlobalState disabled + */ + public function test_output_buffer_adds_crossorigin_to_video_with_source() { + $_SERVER['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36'; + + ob_start(); + + wp_start_cross_origin_isolation_output_buffer(); + echo ''; + + ob_end_flush(); + $output = ob_get_clean(); + + $this->assertStringContainsString( 'crossorigin="anonymous"', $output ); + } + + /** + * Multiple tags in the same output should each be handled correctly. + * + * @ticket 64766 + * + * @runInSeparateProcess + * @preserveGlobalState disabled + */ + public function test_output_buffer_handles_mixed_tags() { + $_SERVER['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36'; + + ob_start(); + + wp_start_cross_origin_isolation_output_buffer(); + echo ''; + echo ''; + echo ''; + + ob_end_flush(); + $output = ob_get_clean(); + + // IMG should NOT have crossorigin. + $this->assertStringContainsString( '', $output, 'IMG should not be modified.' ); + + // Script and audio should have crossorigin. + $this->assertSame( 2, substr_count( $output, 'crossorigin="anonymous"' ), 'Script and audio should both get crossorigin, but not img.' ); + } } From af42cbfb83a1946535f49963f1afac7d77ff3f00 Mon Sep 17 00:00:00 2001 From: adamsilverstein Date: Wed, 18 Mar 2026 12:32:52 -0700 Subject: [PATCH 3/5] Refactor crossorigin tests to use data providers Reduces boilerplate by consolidating 10 individual test methods into two data-provider-driven tests while keeping the same coverage. --- .../tests/media/wpCrossOriginIsolation.php | 233 ++++-------------- 1 file changed, 54 insertions(+), 179 deletions(-) diff --git a/tests/phpunit/tests/media/wpCrossOriginIsolation.php b/tests/phpunit/tests/media/wpCrossOriginIsolation.php index 0fa96cdec8e0a..a84975ee1c493 100644 --- a/tests/phpunit/tests/media/wpCrossOriginIsolation.php +++ b/tests/phpunit/tests/media/wpCrossOriginIsolation.php @@ -186,95 +186,24 @@ public function test_client_side_processing_enabled_on_localhost() { } /** - * This test must run in a separate process because the output buffer - * callback sends HTTP headers via header(), which would fail in the - * main PHPUnit process where output has already started. - * - * @ticket 64766 - * - * @runInSeparateProcess - * @preserveGlobalState disabled - */ - public function test_output_buffer_adds_crossorigin_attributes() { - $_SERVER['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36'; - - // Start an outer buffer to capture the callback-processed output. - ob_start(); - - wp_start_cross_origin_isolation_output_buffer(); - echo ''; - - // Flush the inner buffer to trigger the callback, sending processed output to the outer buffer. - ob_end_flush(); - $output = ob_get_clean(); - - $this->assertStringContainsString( 'crossorigin="anonymous"', $output ); - } - - /** - * Images should not get crossorigin="anonymous" because under - * Document-Isolation-Policy: isolate-and-credentialless, the credentialless - * mode handles image loading without CORS headers. Adding the attribute - * would break external images that don't serve CORS headers. - * - * @ticket 64766 - * - * @runInSeparateProcess - * @preserveGlobalState disabled - */ - public function test_output_buffer_does_not_add_crossorigin_to_images() { - $_SERVER['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36'; - - // Start an outer buffer to capture the callback-processed output. - ob_start(); - - wp_start_cross_origin_isolation_output_buffer(); - echo ''; - - // Flush the inner buffer to trigger the callback, sending processed output to the outer buffer. - ob_end_flush(); - $output = ob_get_clean(); - - $this->assertStringNotContainsString( 'crossorigin="anonymous"', $output ); - } - - /** - * Images with srcset should also not get crossorigin="anonymous". + * Verifies that cross-origin elements get crossorigin="anonymous" added. * * @ticket 64766 * * @runInSeparateProcess * @preserveGlobalState disabled - */ - public function test_output_buffer_does_not_add_crossorigin_to_images_with_srcset() { - $_SERVER['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36'; - - ob_start(); - - wp_start_cross_origin_isolation_output_buffer(); - echo ''; - - ob_end_flush(); - $output = ob_get_clean(); - - $this->assertStringNotContainsString( 'crossorigin="anonymous"', $output ); - } - - /** - * Audio elements with cross-origin sources should get crossorigin="anonymous". * - * @ticket 64766 + * @dataProvider data_elements_that_should_get_crossorigin * - * @runInSeparateProcess - * @preserveGlobalState disabled + * @param string $html HTML input to process. */ - public function test_output_buffer_adds_crossorigin_to_audio() { + public function test_output_buffer_adds_crossorigin( $html ) { $_SERVER['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36'; ob_start(); wp_start_cross_origin_isolation_output_buffer(); - echo ''; + echo $html; ob_end_flush(); $output = ob_get_clean(); @@ -283,114 +212,83 @@ public function test_output_buffer_adds_crossorigin_to_audio() { } /** - * Video elements with cross-origin sources should get crossorigin="anonymous". - * - * @ticket 64766 + * Data provider for elements that should receive crossorigin="anonymous". * - * @runInSeparateProcess - * @preserveGlobalState disabled + * @return array[] */ - public function test_output_buffer_adds_crossorigin_to_video() { - $_SERVER['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36'; - - ob_start(); - - wp_start_cross_origin_isolation_output_buffer(); - echo ''; - - ob_end_flush(); - $output = ob_get_clean(); - - $this->assertStringContainsString( 'crossorigin="anonymous"', $output ); + public function data_elements_that_should_get_crossorigin() { + return array( + 'cross-origin script' => array( + '', + ), + 'cross-origin audio' => array( + '', + ), + 'cross-origin video' => array( + '', + ), + 'cross-origin link stylesheet' => array( + '', + ), + 'cross-origin source inside video' => array( + '', + ), + ); } /** - * Link elements with cross-origin href should get crossorigin="anonymous". + * Verifies that certain elements do not get crossorigin="anonymous" added. * - * @ticket 64766 - * - * @runInSeparateProcess - * @preserveGlobalState disabled - */ - public function test_output_buffer_adds_crossorigin_to_link() { - $_SERVER['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36'; - - ob_start(); - - wp_start_cross_origin_isolation_output_buffer(); - echo ''; - - ob_end_flush(); - $output = ob_get_clean(); - - $this->assertStringContainsString( 'crossorigin="anonymous"', $output ); - } - - /** - * Link elements with imagesrcset should no longer trigger crossorigin="anonymous" - * since imagesrcset handling was removed along with IMG. + * Images are excluded because under Document-Isolation-Policy: + * isolate-and-credentialless, the browser handles cross-origin images + * in credentialless mode without needing explicit CORS headers. * * @ticket 64766 * * @runInSeparateProcess * @preserveGlobalState disabled - */ - public function test_output_buffer_does_not_add_crossorigin_to_link_with_imagesrcset_only() { - $_SERVER['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36'; - - ob_start(); - - wp_start_cross_origin_isolation_output_buffer(); - echo ''; - - ob_end_flush(); - $output = ob_get_clean(); - - $this->assertStringNotContainsString( 'crossorigin="anonymous"', $output, 'Link elements should not get crossorigin based on imagesrcset alone.' ); - } - - /** - * Same-origin URLs should not get crossorigin="anonymous". * - * @ticket 64766 + * @dataProvider data_elements_that_should_not_get_crossorigin * - * @runInSeparateProcess - * @preserveGlobalState disabled + * @param string $html HTML input to process. */ - public function test_output_buffer_does_not_add_crossorigin_to_same_origin_script() { + public function test_output_buffer_does_not_add_crossorigin( $html ) { $_SERVER['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36'; ob_start(); wp_start_cross_origin_isolation_output_buffer(); - echo ''; + echo $html; ob_end_flush(); $output = ob_get_clean(); - $this->assertStringNotContainsString( 'crossorigin="anonymous"', $output, 'Same-origin scripts should not get crossorigin attribute.' ); + $this->assertStringNotContainsString( 'crossorigin="anonymous"', $output ); } /** - * Relative URLs should not get crossorigin="anonymous". - * - * @ticket 64766 + * Data provider for elements that should not receive crossorigin="anonymous". * - * @runInSeparateProcess - * @preserveGlobalState disabled + * @return array[] */ - public function test_output_buffer_does_not_add_crossorigin_to_relative_urls() { - $_SERVER['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36'; - - ob_start(); - - wp_start_cross_origin_isolation_output_buffer(); - echo ''; - - ob_end_flush(); - $output = ob_get_clean(); - - $this->assertStringNotContainsString( 'crossorigin="anonymous"', $output, 'Relative URLs should not get crossorigin attribute.' ); + public function data_elements_that_should_not_get_crossorigin() { + return array( + 'cross-origin img' => array( + '', + ), + 'cross-origin img with srcset' => array( + '', + ), + 'link with cross-origin imagesrcset only' => array( + '', + ), + 'same-origin script' => array( + '', + ), + 'relative URL script' => array( + '', + ), + ); } /** @@ -416,29 +314,6 @@ public function test_output_buffer_does_not_override_existing_crossorigin() { $this->assertStringNotContainsString( 'crossorigin="anonymous"', $output ); } - /** - * Source elements inside video/audio with cross-origin src should add - * crossorigin to the parent element. - * - * @ticket 64766 - * - * @runInSeparateProcess - * @preserveGlobalState disabled - */ - public function test_output_buffer_adds_crossorigin_to_video_with_source() { - $_SERVER['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36'; - - ob_start(); - - wp_start_cross_origin_isolation_output_buffer(); - echo ''; - - ob_end_flush(); - $output = ob_get_clean(); - - $this->assertStringContainsString( 'crossorigin="anonymous"', $output ); - } - /** * Multiple tags in the same output should each be handled correctly. * From b05a89791a8ff633fe3f5208358d1fd6082ac6b9 Mon Sep 17 00:00:00 2001 From: adamsilverstein Date: Wed, 18 Mar 2026 12:44:36 -0700 Subject: [PATCH 4/5] Fix array alignment in crossorigin test data --- tests/phpunit/tests/media/wpCrossOriginIsolation.php | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tests/phpunit/tests/media/wpCrossOriginIsolation.php b/tests/phpunit/tests/media/wpCrossOriginIsolation.php index a84975ee1c493..12d9205f34b90 100644 --- a/tests/phpunit/tests/media/wpCrossOriginIsolation.php +++ b/tests/phpunit/tests/media/wpCrossOriginIsolation.php @@ -273,19 +273,19 @@ public function test_output_buffer_does_not_add_crossorigin( $html ) { */ public function data_elements_that_should_not_get_crossorigin() { return array( - 'cross-origin img' => array( + 'cross-origin img' => array( '', ), - 'cross-origin img with srcset' => array( + 'cross-origin img with srcset' => array( '', ), 'link with cross-origin imagesrcset only' => array( '', ), - 'same-origin script' => array( + 'same-origin script' => array( '', ), - 'relative URL script' => array( + 'relative URL script' => array( '', ), ); From 6c61915036abbf9cb0399a446750140abd8d4fd4 Mon Sep 17 00:00:00 2001 From: adamsilverstein Date: Wed, 18 Mar 2026 13:11:16 -0700 Subject: [PATCH 5/5] Fix same-origin test to use dynamic site_url() The hardcoded http://example.org URL does not match CI configs that use a non-standard port (example.org:8889), causing the test to fail. Use site_url() at runtime. --- .../tests/media/wpCrossOriginIsolation.php | 27 ++++++++++++++++--- 1 file changed, 24 insertions(+), 3 deletions(-) diff --git a/tests/phpunit/tests/media/wpCrossOriginIsolation.php b/tests/phpunit/tests/media/wpCrossOriginIsolation.php index 12d9205f34b90..3ec4231d5bede 100644 --- a/tests/phpunit/tests/media/wpCrossOriginIsolation.php +++ b/tests/phpunit/tests/media/wpCrossOriginIsolation.php @@ -282,15 +282,36 @@ public function data_elements_that_should_not_get_crossorigin() { 'link with cross-origin imagesrcset only' => array( '', ), - 'same-origin script' => array( - '', - ), 'relative URL script' => array( '', ), ); } + /** + * Same-origin URLs should not get crossorigin="anonymous". + * + * Uses site_url() at runtime since the test domain varies by CI config. + * + * @ticket 64766 + * + * @runInSeparateProcess + * @preserveGlobalState disabled + */ + public function test_output_buffer_does_not_add_crossorigin_to_same_origin() { + $_SERVER['HTTP_USER_AGENT'] = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36'; + + ob_start(); + + wp_start_cross_origin_isolation_output_buffer(); + echo ''; + + ob_end_flush(); + $output = ob_get_clean(); + + $this->assertStringNotContainsString( 'crossorigin="anonymous"', $output ); + } + /** * Elements that already have a crossorigin attribute should not be modified. *