Sanitized player properties

[girishpanchal30]

All Submissions:

• Have you followed the Optimole Contributing guideline?
• Does your code follow the WordPress' coding standards?
• Have you checked to ensure there aren't other open Pull Requests for the same update/change?

Changes proposed in this Pull Request:

Sanitized style-related attributes to prevent unsafe values, ensuring only declared attributes are rendered, and added comprehensive unit tests to verify correct behavior and prevent regressions. Added sanitization for primaryColor and aspectRatio attributes to ensure only valid CSS values or known options are used, falling back to safe defaults when necessary. This prevents injection of unsafe styles or scripts.

Closes https://github.com/Codeinwp/optimole-service/issues/1788

Other information:

• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you written new tests for your changes, as applicable?
• Have you successfully ran tests with your changes locally?

[pirate-bot]

Plugin build for c3b118d is ready 🛎️!

• Download build
• Download dev

[Copilot]

🟡 Changes recommended

Invalid color strings bypass the intended fallback.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Secures server-rendered video-player styles and attributes.

Changes:

• Sanitizes color, aspect-ratio, and spacing values.
• Prevents undeclared attributes from reaching markup.
• Adds regression tests.

File summaries

File	Description
inc/video_player.php	Adds defaults and style sanitization.
tests/test-video-player-block.php	Tests secure rendering and fallbacks.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[girishpanchal30]

I have reverted the color sanitization in c3b118d, as we are already escaping its value. Therefore, there is no need to sanitize the color attribute.

[pirate-bot]

Approved: The changed renderer blocks the reported event-attribute injection.

The focused block tests and an Author REST render removed unsafe attributes and preserved expected output.

Validation details

• WordPress 7.1 on PHP 8.3 passed 6 focused tests with 24 assertions.
• An Author REST post rendered without event attributes and sanitized the aspect ratio.
• Both changed PHP files passed syntax checks.

Untested areas

• Browser checks were skipped because the front page had a redirect loop.
• Complex editor spacing values lacked a resolved saved-value contract.

🤖 Automated review · run code-review-agent_6aa277f6760179.11290370.

---

🤖 Review agent — review posted ✅

• Review: APPROVED · 0 findings
• Head: c3b118d
• Duration: 12 min 10 s

Run code-review-agent_6aa277f6760179.11290370 · trail