Modernize Youtube embeds and exempt from Bleach cleaning, abandon Imgur embeds #384
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Problem
https://spacedock.info/markdown says:
However, if you try to use this currently, it just renders as an escaped inline
<iframe>
:https://spacedock.info/mod/141/scatterer
Cause
#336 added a Bleach sanitization pass to our Markdown rendering, which only allows certain tags and attributes to be included in the rendered HTML. Currently
iframe
is not on the allowed list, and the above embedding functionality works by generating aniframe
element.Changes
Now
iframe
is allowed, but we apply extra validation to it. Only the attributes generated by SD's embed code are allowed, and forsrc
specifically, only values beginning with the URL prefixes we use are allowed. If someone tries to use aniframe
with an unauthorized URL, it will just show up as empty:Fixes #383.
Fixes #178.
Side fixes
The embedding functionality was using a deprecated API (assigning a
Pattern
directly to a member ofmd.inlinePatterns
) and is now updated to the newerregister
API. As part of this the KerbDown-related classes are refactored somewhat to put certain values and functions in the classes where they belong.If you click "SHARE" on Youtube, it presents you with a link in the format
https://youtu.be/video_id
. Now we support embedding this format.Imgur's embedding hasn't worked in a long time, and shows no signs of ever being fixed. Now it's removed from the code and from the markdown help page.