SandBox: Fix embed previews that require a referrer in Safari

[Mustafabharmal]

What?

Closes #73288.

Fixes embed previews in Safari for providers that require a referrer. YouTube previews currently fail with "Error 153 Video player configuration error" instead of showing the video.

Why?

YouTube now requires a Referer for embedded players. Embed previews render through SandBox with allowSameOrigin, which fills its iframe with document.open() and document.write(). In Chrome and Firefox, iframes inside that document send the editor page's URL as their referrer. Safari sends no referrer from a document filled with document.open() (WebKit bug 169846), even though the document's URL is correct.

How?

After document.open(), SameOriginSandBox sets the document's URL again with history.replaceState(), which makes Safari send it as the referrer. Firefox throws on this call but already sends the referrer, so the error is caught and ignored. The editor's history isn't affected.

The change isn't specific to YouTube: it applies to every sandbox that uses allowSameOrigin, which covers all oEmbed previews in the Embed block and the Cover block's embedded video background. In Safari, these now send the same referrer they already send in Chrome and Firefox. The isolated sandbox used by the Custom HTML block is unchanged.

An earlier version of this PR moved the editor canvas and the sandbox to srcdoc. That breaks relative hash links in the canvas (see #50875 and #75619), and a srcdoc sandbox inside the blob URL canvas still sends no referrer in any browser. This version leaves the editor canvas iframe unchanged.

Testing Instructions

1. Open the post editor in Safari.
2. Insert a YouTube Embed block and embed https://www.youtube.com/watch?v=dQw4w9WgXcQ.
3. Confirm the video preview loads instead of "Error 153".
4. Embed a few other providers (for example Vimeo, X and Spotify) and confirm they still preview and resize correctly.
5. Add a Cover block with an embedded video background and confirm it still previews.
6. Move the embed block up and down and confirm the preview is still shown.
7. Repeat steps 2 to 6 in Chrome and Firefox and confirm nothing changes.
8. Insert a Custom HTML block with some content and confirm its preview still works.

Screenshots or screencast

Before:

Youtube.testing.Before.mov

After:

Youtube.testing.after.mov

Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Used for: Investigating Safari's referrer behaviour and drafting the change. I reviewed the change and tested it in Safari, Chrome and Firefox.

[github-actions]

🤖 PR meta 🤖

🎉 Props

Unlinked Accounts

The following contributors have not linked their GitHub and WordPress.org accounts: @larskuhnt.

Contributors, please read how to link your accounts to ensure your work is properly credited in WordPress releases.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Unlinked contributors: larskuhnt.

Co-authored-by: Mustafabharmal <mustafabharmal@git.wordpress.org>
Co-authored-by: t-hamano <wildworks@git.wordpress.org>
Co-authored-by: ciampo <mciampini@git.wordpress.org>
Co-authored-by: ellatrix <ellatrix@git.wordpress.org>
Co-authored-by: jkmassel <jkmassel@git.wordpress.org>
Co-authored-by: westonruter <westonruter@git.wordpress.org>
Co-authored-by: dcalhoun <dpcalhoun@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

Updated as activity occurs, without notifying anyone named here. Add the props-bot label to refresh.

[ciampo]

LGTM 🚀

Nit: we could consider adding a WebKit regression test that checks the Referer on a nested iframe request inside the blob-backed editor canvas? The existing sandbox and embedding tests do not cover this failure.

Don't consider this feedback blocking.

[t-hamano]

The CI failure wasn't caused by this PR, but was surfaced by shuffling the order of the unit tests. I'd like to fix it in a separate PR.

[ciampo]

was surfaced by #83111

Yes, the shuffling is there on purpose to add another layer of resilience (and reliability) to the tests :) Thank yoU!