Skip to content

Filter scripts from base64 website artifacts - #875

Open
chubes4 wants to merge 2 commits into
mainfrom
fix/874-base64-script-policy
Open

Filter scripts from base64 website artifacts#875
chubes4 wants to merge 2 commits into
mainfrom
fix/874-base64-script-policy

Conversation

@chubes4

@chubes4 chubes4 commented Aug 8, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • decode base64-only HTML before applying the inert client-script policy
  • write filtered bytes back in the artifact's original representation
  • hash decoded script bytes in policy reports and preserve isolated-preview artifacts byte-for-byte

Fixes #874.

This unblocks the combined fixture matrix for Automattic/blocks-engine#688 and Automattic/blocks-engine#822: canonical fixture 10-nonprofit no longer retains js/main.js markup after the corresponding script asset is dropped.

Verification

  • php tests/smoke-client-script-policy.php (12 assertions)
  • npm test (54 selected commands passed; fixture-matrix suite 261/261)
  • fixture 10-nonprofit through patched SSI policy plus combined Blocks Engine commit 598c6898: valid WordPress site plan, zero diagnostics
  • php -l includes/class-static-site-importer-client-script-policy.php
  • php -l tests/smoke-client-script-policy.php
  • git diff --check

AI assistance

OpenAI gpt-5.6-sol via OpenCode traced the WP Codebox fixture-matrix failure, isolated the base64 policy mismatch, implemented the fix and contract coverage, and ran verification. Chris Huber directed the work and remains responsible for every line.

chubes4 added 2 commits August 7, 2026 21:06
AI assistance: OpenAI gpt-5.6-sol via OpenCode traced the fixture-matrix failure, implemented representation-aware script filtering, added contract coverage, and ran verification. Chris Huber directed the work and remains responsible for every line.
AI assistance: OpenAI gpt-5.6-sol via OpenCode added precise PHPCS suppressions for declared artifact base64 decoding and representation-preserving encoding, then ran the policy and repository test suites. Chris Huber remains responsible for every line.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Apply inert client-script policy to base64 HTML artifacts

1 participant