Add Media Resource Checker plugin

[t-hamano]

Closes: https://meta.trac.wordpress.org/ticket/8149

This PR adds a plugin that displays a warning for blocks that contain inappropriate external resources. This helps encourage contributors to upload resources when creating documentation by copying content from external documents, preventing media from potentially disappearing in the future.

How this plugin works

• Check the three blocks that allow you to set external resources as media.
• Check whether the media URL matches your site's domain. If not, this plugin checks whether it matches one of the allowed domains. Finally, if the media URL does not match any domain, it is considered an inappropriate media resource.
• Blocks with invalid media resources will have a red border and overlay.
  Additionally, the block toolbar will have a red icon button. Clicking that button will display a popover with details about the error.

Testing Instructions

Use the .wp-env.override.json file to map the plugin to your local wp-env environment:

{
	"plugins": [
		"./your/plugins/plugin",
		"../path/to/wordpress.org/wordpress.org/public_html/wp-content/plugins/wporg-media-resource-checker"
	]
}

Screenshot

[t-hamano]

I'm not sure if this is the right place for this file; maybe it should be in a higher directory to cover all plugin files?

[dd32]

We can probably define this into /.gitignore or just leave it in the project-specific area since it doesn't matter all that much.

[t-hamano]

I have no strong opinion about where this file should be located 😄 Please feel free to move it elsewhere if necessary.

[dd32]

Can we use WordPressdotorg\Media_Resource_Checker instead?

[dd32]

I'm not sure what the purpose of this is? Importing the functions defined in the current file into the file?

[t-hamano]

I've imitated the implementation of the Learn plugin:

wordpress.org/wordpress.org/public_html/wp-content/plugins/wporg-learn/wporg-learn.php

Lines 25 to 41 in 8cafcd5

	/**
	* Shortcut to the build directory.
	*
	* @return string
	*/
	function get_build_path() {
	return PLUGIN_DIR . 'build/';
	}
	/**
	* Shortcut to the build URL.
	*
	* @return string
	*/
	function get_build_url() {
	return PLUGIN_URL . 'build/';
	}

wordpress.org/wordpress.org/public_html/wp-content/plugins/wporg-learn/inc/events.php

Line 7 in 8cafcd5

use function WPOrg_Learn\{ get_build_path, get_build_url };

We can also use an approach that doesn't use it if we don't need it.

[t-hamano]

Fixed in 9d72889

[dd32]

We can probably define this into /.gitignore or just leave it in the project-specific area since it doesn't matter all that much.

[dd32]

I'm wondering if wp.com should be allowed here, since WordPress.org != WordPress.com, and often using wpcom hosted images ends up invalid.

I can imagine this might also be intended for photon images? In which case, allowing ^(.*\.)?wp.com/(.*\.)?wordpress\.org/ could make sense?

[t-hamano]

I can imagine this might also be intended for photon images?

Yes, that's right. For example, the handbook uses images that are actually delivered from the Photon CDN:

https://github.com/search?q=repo%3AWordPress%2Fdeveloper-plugins-handbook%20wp.com&type=code

In which case, allowing ^(.*\.)?wp.com/(.*\.)?wordpress\.org/ could make sense?

I agree, fixed in e1db353.

Specific examples of allowed URLs can be found here.

https://github.com/WordPress/wordpress.org/pull/536/changes#diff-6b3ed010975581690ee4c331ff822c288910b4e110783cb70ede501d96183e36R66-R70

[dd32]

We likely should also allow the WordPress.org CDNs here:

Suggested change

	{
	authority: 'wordpress.org',
	regex: /^(.*\.)?wordpress\.org$/,
	},
	{
	authority: 'wordpress.org',
	regex: /^(.*\.)?wordpress\.org$/,
	},
	{
	authority: 'wordpress.org',
	regex: /^(.*\.)?w\.org$/,
	},

Eg; https://s.w.org/images/core/6.9/01-notes.webp?v=24082

[t-hamano]

Fixed in 302493e

Just to be sure, I have distinguished between the authority texts wordpress.org and w.org.