Bug Description

When adding a NY Times article to an Embed block a validation error for an invalid security attribute is reported.

This may be a wider issue with WordPress post embeds (#809), but since the oEmbed response actually doesn't include the security attribute:

<iframe src="https://www.nytimes.com/svc/oembed/html/?url=https%3A%2F%2Fwww.nytimes.com%2F2017%2F02%2F14%2Fbusiness%2Fdealbook%2Fbundling-online-services.html" scrolling="no" frameborder="0" allowtransparency="true" title="Don’t Look Now, but the Great Unbundling Has Spun Into Reverse" style="border:none;max-width:500px;min-width:300px;min-height:550px;display:block;width:100%;"></iframe>

Perhaps WordPress core is overriding the embed as a special case? In the non-AMP version, it is generating:

<iframe title="Don’t Look Now, but the Great Unbundling Has Spun Into Reverse" class="wp-embedded-content" sandbox="allow-scripts" security="restricted" src="https://www.nytimes.com/svc/oembed/html/?url=https%3A%2F%2Fwww.nytimes.com%2F2017%2F02%2F14%2Fbusiness%2Fdealbook%2Fbundling-online-services.html#?secret=Rzr8mKi8LT" data-secret="Rzr8mKi8LT" scrolling="no" frameborder="0"></iframe>

This results in an entirely broken embed on the frontend, even outside of AMP:

So there are perhaps two issues here:

1. NY Times embeds are broken in core.
2. Post embeds should more gracefully be handled while waiting for Improve handling of WordPress post embeds #809 by just stripping out the security attribute (which I believe is obsolete in favor of sandbox).

Expected Behaviour

No validation error should occur.

Steps to reproduce

1. Enable Transitional or Standard mode.
2. Add an Embed block and provide the URL https://www.nytimes.com/2017/02/14/business/dealbook/bundling-online-services.html
3. Safe draft
4. See validation error

Screenshots

Do not alter or remove anything below. The following sections will be managed by moderators only.

Acceptance criteria

Implementation brief

QA testing instructions

Demo

Changelog entry