Use exact match with IframeAllowlist (#799)

googlecodelabs · Nov 9, 2022 · 6d81f90 · 6d81f90
1 parent 966d39d
commit 6d81f90
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/claat/parser/gdoc/parse.go b/claat/parser/gdoc/parse.go
@@ -686,7 +686,7 @@ func image(ds *docState) nodes.Node {
 		// For iframe, make sure URL ends in allowlisted domain.
 		ok := false
 		for _, domain := range nodes.IframeAllowlist {
-			if strings.HasSuffix(u.Hostname(), domain) {
+			if u.Hostname() == domain {
 				ok = true
 				break
 			}

diff --git a/claat/parser/md/parse.go b/claat/parser/md/parse.go
@@ -776,7 +776,7 @@ func image(ds *docState) nodes.Node {
 		// For iframe, make sure URL ends in allowlisted domain.
 		ok := false
 		for _, domain := range nodes.IframeAllowlist {
-			if strings.HasSuffix(u.Hostname(), domain) {
+			if u.Hostname() == domain {
 				ok = true
 				break
 			}