Media: Remove IMG from crossorigin attribute injection by adamsilverstein · Pull Request #11291 · WordPress/wordpress-develop

adamsilverstein · 2026-03-18T17:31:19Z

Trac ticket: https://core.trac.wordpress.org/ticket/64886

Related Gutenberg issue: WordPress/gutenberg#76476

Description

Removes IMG from the list of elements that receive crossorigin="anonymous" in wp_add_crossorigin_attributes(). Also removes the related imagesrcset handling from LINK elements.

Under Document-Isolation-Policy: isolate-and-credentialless (introduced in r61844), the browser's credentialless mode already handles cross-origin image loading without requiring CORS headers on the remote server. Explicitly adding crossorigin="anonymous" to <img> elements overrides this behavior and forces a CORS preflight — breaking images from servers that don't include Access-Control-Allow-Origin in their response headers.

This causes image previews to break in the block editor sidebar when an image block references an external URL (e.g. https://placehold.jp/1024x768.jpg).

Related Gutenberg PR: WordPress/gutenberg#76618

Changes

Remove IMG entry from $cross_origin_tag_attributes in wp_add_crossorigin_attributes()
Remove imagesrcset from LINK entry (used for <link> preload tags for images — same issue)
Update existing test to use <script> instead of <img> for the positive case
Add new test asserting <img> does NOT get crossorigin="anonymous"

Testing

Open block editor in Chromium 137+
Add an Image block → "Insert from URL" → https://placehold.jp/1024x768.jpg
Sidebar preview should render correctly (no CORS error)
Verify Document-Isolation-Policy: isolate-and-credentialless header is still sent
Drag an image from desktop onto the editor — client-side media processing still works

Commit message

Media: Remove `IMG` from crossorigin attribute injection.

Under `Document-Isolation-Policy: isolate-and-credentialless`, the browser's credentialless mode already handles cross-origin image loading without requiring CORS headers. Explicitly adding `crossorigin="anonymous"` to `<img>` elements overrides this behavior and forces a CORS preflight request, breaking images from servers that don't include `Access-Control-Allow-Origin` in their response headers.

This also removes the related `imagesrcset` handling from `LINK` elements, which had the same issue for `<link>` preload tags for images.

See related Gutenberg issue: https://github.com/WordPress/gutenberg/issues/76476.

Follow-up to [61844], [61846].

Props adamsilverstein, swissspidy.
Fixes #64886.

Under Document-Isolation-Policy: isolate-and-credentialless, the browser handles cross-origin images in credentialless mode without needing explicit CORS headers. Adding crossorigin="anonymous" to img elements overrides this and breaks external images whose servers don't serve CORS headers (e.g. sidebar previews for external image URLs). Also removes imagesrcset handling from LINK elements for the same reason. See #64766.

github-actions · 2026-03-18T17:31:33Z

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props adamsilverstein, swissspidy, westonruter.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

github-actions · 2026-03-18T17:40:27Z

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

All changes will be lost when closing a tab with a Playground instance.
All changes will be lost when refreshing the page.
A fresh instance is created each time the link below is clicked.
Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

Add tests for audio, video, link, source elements, srcset on images, imagesrcset on links, same-origin and relative URLs, existing crossorigin preservation, and mixed tags.

Reduces boilerplate by consolidating 10 individual test methods into two data-provider-driven tests while keeping the same coverage.

adamsilverstein · 2026-03-18T19:44:54Z

Added a proposed commit message to the PR description.

The hardcoded http://example.org URL does not match CI configs that use a non-standard port (example.org:8889), causing the test to fail. Use site_url() at runtime.

westonruter · 2026-03-18T23:25:17Z

Why are images the one exception that don't need crossorign=anonymous? Why do VIDEO, AUDIO, et al specifically require it?

westonruter · 2026-03-18T23:27:17Z

tests/phpunit/tests/media/wpCrossOriginIsolation.php

+	 * @param string $html HTML input to process.
 	 */
-	public function test_output_buffer_adds_crossorigin_attributes() {
+	public function test_output_buffer_adds_crossorigin( $html ) {


Suggested change

public function test_output_buffer_adds_crossorigin( $html ) {

public function test_output_buffer_adds_crossorigin( string $html ) {

westonruter · 2026-03-18T23:28:04Z

tests/phpunit/tests/media/wpCrossOriginIsolation.php

+	 * @return array[]
+	 */
+	public function data_elements_that_should_get_crossorigin() {


Suggested change

* @return array[]

*/

public function data_elements_that_should_get_crossorigin() {

* @return array<string, array{ 0: string }>

*/

public function data_elements_that_should_get_crossorigin(): array {

westonruter · 2026-03-18T23:28:20Z

tests/phpunit/tests/media/wpCrossOriginIsolation.php

+	 *
+	 * @param string $html HTML input to process.
+	 */
+	public function test_output_buffer_does_not_add_crossorigin( $html ) {


Suggested change

public function test_output_buffer_does_not_add_crossorigin( $html ) {

public function test_output_buffer_does_not_add_crossorigin( string $html ) {

andrewserong

Thanks for handling the change here! The code change looks good, and I think we'll only be able to confirm in the block editor once WordPress/gutenberg#76618 is included in the next Gutenberg sha bump.

LGTM 🚀

github-actions · 2026-03-19T00:11:15Z

A commit was made that fixes the Trac ticket referenced in the description of this pull request.

SVN changeset: 62048
GitHub commit: 5f16124

This PR will be closed, but please confirm the accuracy of this and reopen if there is more work to be done.

adamsilverstein requested review from andrewserong, swissspidy and westonruter March 18, 2026 17:32

adamsilverstein self-assigned this Mar 18, 2026

adamsilverstein mentioned this pull request Mar 18, 2026

Cross Origin Isolation: Remove img from the list of elements that get mutated WordPress/gutenberg#76618

Merged

Expand crossorigin isolation test coverage

d033f2a

Add tests for audio, video, link, source elements, srcset on images, imagesrcset on links, same-origin and relative URLs, existing crossorigin preservation, and mixed tags.

swissspidy approved these changes Mar 18, 2026

View reviewed changes

adamsilverstein added 2 commits March 18, 2026 12:32

Refactor crossorigin tests to use data providers

af42cbf

Reduces boilerplate by consolidating 10 individual test methods into two data-provider-driven tests while keeping the same coverage.

Fix array alignment in crossorigin test data

b05a897

Fix same-origin test to use dynamic site_url()

6c61915

The hardcoded http://example.org URL does not match CI configs that use a non-standard port (example.org:8889), causing the test to fail. Use site_url() at runtime.

adamsilverstein mentioned this pull request Mar 18, 2026

Image previews are not displayed in the sidebar of image blocks in a WordPress 7.0 + wp-env environment. WordPress/gutenberg#76476

Closed

6 tasks

github-actions bot mentioned this pull request Mar 18, 2026

PHP backports for WP 7.0 WordPress/gutenberg#74043

Open

westonruter reviewed Mar 18, 2026

View reviewed changes

andrewserong approved these changes Mar 18, 2026

View reviewed changes

github-actions bot closed this Mar 19, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Media: Remove IMG from crossorigin attribute injection#11291

Media: Remove IMG from crossorigin attribute injection#11291
adamsilverstein wants to merge 5 commits intoWordPress:trunkfrom
adamsilverstein:fix/remove-img-crossorigin-isolation

adamsilverstein commented Mar 18, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Mar 18, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Mar 18, 2026

Uh oh!

adamsilverstein commented Mar 18, 2026

Uh oh!

westonruter commented Mar 18, 2026 •

edited

Loading

Uh oh!

westonruter Mar 18, 2026

Uh oh!

westonruter Mar 18, 2026

Uh oh!

westonruter Mar 18, 2026

Uh oh!

andrewserong left a comment

Uh oh!

github-actions bot commented Mar 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

	public function test_output_buffer_adds_crossorigin( $html ) {
	public function test_output_buffer_adds_crossorigin( string $html ) {

	public function test_output_buffer_does_not_add_crossorigin( $html ) {
	public function test_output_buffer_does_not_add_crossorigin( string $html ) {

Conversation

adamsilverstein commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Changes

Testing

Commit message

Uh oh!

github-actions bot commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Mar 18, 2026

Test using WordPress Playground

Some things to be aware of

Uh oh!

adamsilverstein commented Mar 18, 2026

Uh oh!

westonruter commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

westonruter Mar 18, 2026

Choose a reason for hiding this comment

Uh oh!

westonruter Mar 18, 2026

Choose a reason for hiding this comment

Uh oh!

westonruter Mar 18, 2026

Choose a reason for hiding this comment

Uh oh!

andrewserong left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Mar 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

adamsilverstein commented Mar 18, 2026 •

edited

Loading

github-actions bot commented Mar 18, 2026 •

edited

Loading

westonruter commented Mar 18, 2026 •

edited

Loading