jekyll-embed-urls 0.1.0 → 0.3.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 35c0f485187e769d27b2459ff7a12c24ed913ae2eff55ac9ba4867ca50717454
-  data.tar.gz: 27653e6672c5dfd60836db89f35a2c4ec7088ce1b65eced7f8a0be89564e586e
+  metadata.gz: 5e8b338448bae54c12ee6c9119852b2d93859ddd032c242ace46c0515eb2a4eb
+  data.tar.gz: fc960acd1bec7c2f189e7c46cf20739026395700827dd7b5f79c6937178c5c0a
 SHA512:
-  metadata.gz: 9efcd5d53d829267f0f58c3f44eb7ffd23da559fea2e8af102300beb7038b57acb0a2f5c8e263bd3ea2c54e7b8b708feb8eff18b9fcab665bb8cc007072001f8
-  data.tar.gz: 1cc3c943f041820ca211b63561897404ae24e8d0da2889b200a0041c41859b203f452497c41575f4187374ec3339919adf46228f851ac4e82e3c0dc95dcd5cd7
+  metadata.gz: db3a88054e7716581d5b87dbf302138331e7e8b11571946d0389eb93c9e2cdc5d9b3e5212cfe7af941d7d9346893e69b80c26d5aabec717d12b0ff4cd94a69b9
+  data.tar.gz: f5ef11ac9fa6b6ab8d0826cb0d024ff4a01de43645a7123e4b28832f29a7a61eef332004646618834fa80f2f7f2bb870efe074cd32200112364da3cc143c3adc

data/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## v0.3.3
+
+* Add `allow-popups` to sandbox so you can open links in a new window.
+
+## v0.3.2
+
+* Rescue `OEmbed::Error`
+
+## v0.3.1
+
+* Put link inside a paragraph so markdown ignores the HTML
+
+## v0.3.0
+
+* Reuse the iframe and sandbox it if the embed code contains one
+
+* Use a Referrer-Policy
+
+  https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy
+
+  https://web.dev/referrer-best-practices/
+
+## v0.2.0
+
+* Use a sandboxed iframe
+
 ## v0.1.0
 
 * Supports OEmbed!

data/README.md

@@ -46,6 +46,9 @@ https://www.invidio.us/watch?v=XYHnd4boUoM
 **Note:** The URL can be anywhere, at the start, end or between
 paragraphs but it needs to be in its own block of text.
 
+**Another note:** [Invidious doesn't support OEmbed
+yet](https://github.com/omarroth/invidious/issues/1222) :P
+
 
 ## Contributing
 
@@ -55,6 +58,9 @@ intended to be a safe, welcoming space for collaboration, and
 contributors are expected to adhere to the [Sutty code of
 conduct](https://sutty.nl/en/code-of-conduct/).
 
+If you like our plugins, [please consider
+donating](https://donaciones.sutty.nl/en/)!
+
 ## License
 
 The gem is available as free software under the terms of the GPL3

data/lib/jekyll-embed-urls.rb

@@ -1,4 +1,16 @@
 require 'oembed'
+require 'cgi'
+require 'oga'
+
+# TODO: We tested several of the mainstream embedable contents (YT, IG,
+# Twitter) and specially IG and Twitter just want to take over the page
+# to set their own size, also send metrics.  So they won't work on a
+# sandboxed iframe, which we were expecting, but they also won't be
+# comfortable for visitors to use.  We're planning on using OGP and
+# render our own partials (configurable) for this.  This way everything
+# is safer and the embedded content even adapts to the site's design.
+#
+# So, expect a major refactoring!
 
 OEmbed::Providers.register_all
 OEmbed::Providers.register_fallback(OEmbed::ProviderDiscovery,
@@ -9,35 +21,68 @@ OEmbed::Providers.register_fallback(OEmbed::ProviderDiscovery,
 Jekyll::Hooks.register :site, :pre_render do |site|
   # Cache results
   cache ||= Jekyll::Cache.new('Jekyll::OEmbed::Urls')
+  # TODO: Make configurable
+  referrer_policy = 'strict-origin-when-cross-origin'
 
   # Only modify documents to be written
   site.docs_to_write.each do |doc|
     # Skip text paragraphs
-    next unless %r{\n\nhttps?://} =~ doc.content
+    # XXX: Find link in first line
+    next unless %r{\n\n\s*<?https?://} =~ doc.content
 
     # Split texts by markdown blocks
     doc.content = doc.content.split("\n\n").map do |p|
       # Only process lines with URLs
-      if %r{https?://} =~ p
-        # Remove empty characters
-        p.strip!
+      next p unless %r{\A\s*<?https?://} =~ p
+      # Remove empty characters and markdown autolinks
+      p = p.strip.tr('<', '').tr('>', '')
+
+      # @see {https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-sandbox}
+      same_origin = p.start_with? site.config['url']
+
+      Jekyll.logger.debug "Finding OEmbed content for #{p}"
+      # Cache the results
+      cache.getset(p) do
+        Jekyll.logger.debug "=> Not cached, obtaining..."
+
+        result = OEmbed::Providers.get(p)
+        sandbox = "allow-scripts allow-popups #{same_origin ? '' : 'allow-same-origin'}"
 
-        Jekyll.logger.debug "Finding OEmbed content for #{p}"
-        # Cache the results
-        cache.getset(p) do
-          Jekyll.logger.debug "=> Not cached, obtaining..."
+        # If the embed HTML contains an iframe, make sure it has the
+        # correct attributes.
+        if %r{<iframe } =~ result.html
+          html = Oga.parse_html result.html
 
-          OEmbed::Providers.get(p).html
+          html.css('iframe').each do |iframe|
+            iframe.attributes.delete_if do |attr|
+              %w[width height].include? attr.name
+            end
+
+            iframe.attributes << Oga::XML::Attribute.new(name: 'sandbox', value: sandbox)
+            iframe.attributes << Oga::XML::Attribute.new(name: 'referrerpolicy', value: referrer_policy)
+          end
+
+          html.to_xml
+        else
+          # Return a sandboxed iframe with the size of the HTML.  We
+          # only allow scripts to run inside the iframe and nothing
+          # else.
+          <<~IFRAME
+            <iframe
+              referrerpolicy="#{referrer_policy}"
+              sandbox="#{sandbox}"
+              style="min-width:#{result.width}px;min-height:#{result.height || 0}px"
+              srcdoc="#{CGI.escape_html result.html}"></iframe>
+          IFRAME
+        end
+      rescue OEmbed::Error => e
         # If the URL doesn't support OEmbed just return an external
         # link.
-        rescue OEmbed::NotFound => e
-          Jekyll.logger.warn "#{p} is not oembeddable, showing as URL"
+        #
+        # TODO: Fetch information with OGP and render a template.
+        Jekyll.logger.warn "#{p} is not oembeddable or URL can't be fetched, showing as URL: #{e}"
 
-          "<a href=\"#{p}\" target=\"_blank\">#{p}</a>"
-        end
-      # Otherwise return the original block
-      else
-        p
+        %(<p><a href="#{p}" target="_blank" referrerpolicy="#{referrer_policy}">#{p}</a></p>)
       end
     # Rebuild the content
     end.join("\n\n")

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: jekyll-embed-urls
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.3.3
 platform: ruby
 authors:
 - f
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2020-06-06 00:00:00.000000000 Z
+date: 2020-10-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jekyll
@@ -25,7 +25,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '4'
 - !ruby/object:Gem::Dependency
-  name: oembed
+  name: ruby-oembed
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
@@ -38,6 +38,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.13'
+- !ruby/object:Gem::Dependency
+  name: oga
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.15'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.15'
 description: Replaces URLs for their previsualization in Jekyll posts
 email:
 - f@sutty.nl
@@ -61,7 +75,7 @@ metadata:
   source_code_uri: https://0xacab.org/sutty/jekyll/jekyll-embed-urls
   changelog_uri: https://0xacab.org/sutty/jekyll/jekyll-embed-urls/-/blob/master/CHANGELOG.md
   documentation_uri: https://rubydoc.info/gems/jekyll-embed-urls
-post_install_message: 
+post_install_message:
 rdoc_options:
 - "--title"
 - jekyll-embed-urls - Embed URL previsualization in Jekyll posts
@@ -76,15 +90,15 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - "~>"
     - !ruby/object:Gem::Version
-      version: '2'
+      version: '2.6'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
-signing_key: 
+rubygems_version: 3.1.2
+signing_key:
 specification_version: 4
 summary: Embed URL previsualization in Jekyll posts
 test_files: []