Convert <iframe> allowlist setting to provider IDs

Asherah Connorrequested to merge
kiv/convert-iframe-allowlist-setting-to-provider-ids into master

What does this MR do and why?

Converts the <iframe> domain allowlist setting to instead be a provider list, driven by the configuration added in !254944 (merged).

  • iframe_rendering_allowlist is changed from a list of domains we permit <iframe>s from, to a list of enabled provider IDs (as defined in !254944 (merged))
  • The validations are updated to accept only known provider IDs.
    • We clear the existing iframe_rendering_allowlist setting in a post-deploy migration. This setting has been set only on gstg/gprd, under a type: wip default_enabled: false FF. If we don't clear the existing setting, validations will fail on unrelated saves.
  • Drop the old child-src addition. This was only needed for ~pre-2022 versions of Safari, which we don't generally support. Without it, embeds which require service workers won't work on Safari 15.3 and below.

After this MR is merged, and before the following MR Draft: Move to `<iframe>` providers (!254946) is merged, <iframe> embed functionality can't be used. It's type: wip, there are no current users, and the FF was deleted three weeks ago in all environments in anticipation of this.

MR stack

MR 3/9 of Rework <iframe> embed configuration (#599713):

  1. Add `<iframe>` provider model and parser (!254943 - merged)
  2. Add `<iframe>` provider loader and base config (!254944 - merged)
  3. Convert `<iframe>` allowlist setting to provide... (!254945) ⬅️ you are here
  4. Draft: Move to `<iframe>` providers (!254946)
  5. Draft: Remove dead `<iframe>` transform code (!254947)
  6. Draft: Frontend `<iframe>` hardening (!254948)
  7. Draft: Click-to-activate functionality for `<if... (!254949)
  8. Draft: Admin UI for `<iframe>` providers (!254950)
  9. Draft: Mark `<iframe>` provider loader and conf... (!255246)

Part of <iframe> embeds in Markdown content (#282443).

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Asherah Connor

Merge request reports