jekyll-embed-urls 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 38bf8e56a0b446544b161c172f12b013b89b9f30907888cc57eaef2a9c9abc1b
-  data.tar.gz: 765fa0635ce932982fc14279fc007127883aab30c456887b9a166160477855c5
+  metadata.gz: '00388f250c4eb3227080c3dfb580b6a436c0fb1e58c877b650f4bd4f279b27e9'
+  data.tar.gz: 1ae33d07ca3576dc0421f657f503884be86e809c6489e8a005fd9f9e3eff6f93
 SHA512:
-  metadata.gz: 6434287bd81791b0420c0d80b995d37222c80370db283f2297b7b9542792f069315621d59e8de1b79aca2597381cc875c0a0313b6e0aa8130b7defb50fe03ab7
-  data.tar.gz: 5a41d00060687e833e82672ffbd44dfc99aa67b3ff9ab42167a5db58085a96b0a1c538f1203396ba6c102e28c7b98f77e48a1e0b5832433fa1115e3b2f2a1d9d
+  metadata.gz: f034c24e5376036b2e1c38e174d2a46a1c909b3e834d5841cbacbed33bae5fd5898e8d0501dc5d14a4d25cad728937d72d111fad20d2eee1486e0d777516ee32
+  data.tar.gz: 79583d31b31cc5d2d7de674091045b8c466d0e95cd2356a94393a3c24c1f23cc1e27172565cc535b8c35dc4aa66936699cf201e768be7572b2eef97e5c9d8f9a

data/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## v0.3.0
+
+* Reuse the iframe and sandbox it if the embed code contains one
+
+* Use a Referrer-Policy
+
+  https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy
+
+  https://web.dev/referrer-best-practices/
+
 ## v0.2.0
 
 * Use a sandboxed iframe

data/README.md

@@ -58,6 +58,9 @@ intended to be a safe, welcoming space for collaboration, and
 contributors are expected to adhere to the [Sutty code of
 conduct](https://sutty.nl/en/code-of-conduct/).
 
+If you like our plugins, [please consider
+donating](https://donaciones.sutty.nl/en/)!
+
 ## License
 
 The gem is available as free software under the terms of the GPL3

data/lib/jekyll-embed-urls.rb

@@ -1,60 +1,88 @@
 require 'oembed'
 require 'cgi'
+require 'oga'
 
+# TODO: We tested several of the mainstream embedable contents (YT, IG,
+# Twitter) and specially IG and Twitter just want to take over the page
+# to set their own size, also send metrics.  So they won't work on a
+# sandboxed iframe, which we were expecting, but they also won't be
+# comfortable for visitors to use.  We're planning on using OGP and
+# render our own partials (configurable) for this.  This way everything
+# is safer and the embedded content even adapts to the site's design.
+#
+# So, expect a major refactoring!
+
+OEmbed::Providers.register_all
+OEmbed::Providers.register_fallback(OEmbed::ProviderDiscovery,
+                                    OEmbed::Providers::Noembed)
 
 # Process the content of documents before rendering them to find URLs in
 # a block.
 Jekyll::Hooks.register :site, :pre_render do |site|
   # Cache results
   cache ||= Jekyll::Cache.new('Jekyll::OEmbed::Urls')
+  # TODO: Make configurable
+  referrer_policy = 'strict-origin-when-cross-origin'
 
   # Only modify documents to be written
   site.docs_to_write.each do |doc|
     # Skip text paragraphs
-    next unless %r{\n\nhttps?://} =~ doc.content
+    # XXX: Find link in first line
+    next unless %r{\n\n\s*<?https?://} =~ doc.content
 
     # Split texts by markdown blocks
     doc.content = doc.content.split("\n\n").map do |p|
       # Only process lines with URLs
-      if %r{\Ahttps?://} =~ p
-        # Remove empty characters
-        p.strip!
+      next p unless %r{\A\s*<?https?://} =~ p
+      # Remove empty characters and markdown autolinks
+      p = p.strip.tr('<', '').tr('>', '')
+
+      # @see {https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-sandbox}
+      same_origin = p.start_with? site.config['url']
+
+      Jekyll.logger.debug "Finding OEmbed content for #{p}"
+      # Cache the results
+      cache.getset(p) do
+        Jekyll.logger.debug "=> Not cached, obtaining..."
+
+        result = OEmbed::Providers.get(p)
+        sandbox = "allow-scripts #{same_origin ? '' : 'allow-same-origin'}"
 
-        # @see {https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-sandbox}
-        same_origin = p.start_with? site.config['url']
+        # If the embed HTML contains an iframe, make sure it has the
+        # correct attributes.
+        if %r{<iframe } =~ result.html
+          html = Oga.parse_html result.html
 
-        Jekyll.logger.debug "Finding OEmbed content for #{p}"
-        # Cache the results
-        cache.getset(p) do
-          Jekyll.logger.debug "=> Not cached, obtaining..."
+          html.css('iframe').each do |iframe|
+            iframe.attributes.delete_if do |attr|
+              %w[width height].include? attr.name
+            end
 
-          result = OEmbed::Providers.get(p)
+            iframe.attributes << Oga::XML::Attribute.new(name: 'sandbox', value: sandbox)
+            iframe.attributes << Oga::XML::Attribute.new(name: 'referrerpolicy', value: referrer_policy)
+          end
 
+          html.to_xml
+        else
           # Return a sandboxed iframe with the size of the HTML.  We
           # only allow scripts to run inside the iframe and nothing
           # else.
           <<~IFRAME
             <iframe
-              referrerpolicy="no-referrer"
-              sandbox="allow-scripts #{same_origin ? '' : 'allow-same-origin'}"
+              referrerpolicy="#{referrer_policy}"
+              sandbox="#{sandbox}"
               style="min-width:#{result.width}px;min-height:#{result.height || 0}px"
-              srcdoc="#{CGI.escape_html result.html}"
-              ></iframe>
+              srcdoc="#{CGI.escape_html result.html}"></iframe>
           IFRAME
-
-          result.html
-        rescue OEmbed::NotFound => e
-          # If the URL doesn't support OEmbed just return an external
-          # link.
-          #
-          # TODO: Fetch information with OGP and render a template.
-          Jekyll.logger.warn "#{p} is not oembeddable or URL can't be fetched, showing as URL"
-
-          "<a href=\"#{p}\" target=\"_blank\">#{p}</a>"
         end
-      else
-        # Otherwise return the original block
-        p
+      rescue OEmbed::NotFound => e
+        # If the URL doesn't support OEmbed just return an external
+        # link.
+        #
+        # TODO: Fetch information with OGP and render a template.
+        Jekyll.logger.warn "#{p} is not oembeddable or URL can't be fetched, showing as URL"
+
+        %(<a href="#{p}" target="_blank" referrerpolicy="#{referrer_policy}">#{p}</a>)
       end
     # Rebuild the content
     end.join("\n\n")

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: jekyll-embed-urls
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - f
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2020-07-23 00:00:00.000000000 Z
+date: 2020-08-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jekyll
@@ -38,6 +38,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.13'
+- !ruby/object:Gem::Dependency
+  name: oga
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.15'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.15'
 description: Replaces URLs for their previsualization in Jekyll posts
 email:
 - f@sutty.nl