onebox 1.9.30 → 2.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 72df1362582e006323722a42dc0787537c297df11f0c0e950b243759b10f74d7
-  data.tar.gz: d0e483271248e8efc72207ec28dae1836e3469376fc7849383201906d4c522e2
+  metadata.gz: ebbcb2268bcade7ace9670046cfbf13f58862561b59802ef0011bc8ae869a6a7
+  data.tar.gz: 51e35394339f1cdd6c6dc7be9971bbc7a0e8b8f9a31b483d877e96be86319e0f
 SHA512:
-  metadata.gz: 2277c8b9be42305155c66fb4d97e5987868e34a997f87827a3189ab8073a538ae3afd0b9c89b0271e0671c334d096e87813360ef140298fcdfac2fa58948239a
-  data.tar.gz: ae8306987d4a6ac15fb95a76a9ff44816fc9b84bd73f3ad4af63963fe40834b17de9d7d125f3e92a50ea523ab2cc84cf6b90eea1e8100abe62d991444dd8b946
+  metadata.gz: 9f540f3437675e0abb5ccb25013b9b516e6bb101a21a26e00a2ecf111940bc660ef8706122f805a279cb67e85823be82183d9f095bc86a7aa7f494c0ecd68645
+  data.tar.gz: 82295ede48990cf922e1e3e6cce645cd1caf4f9965d8e289d756d727f4b7886e116a5ffa1676f7df3873d524b28161c30c75478e2008887a80324e2ed8639fde

data/README.md

@@ -71,12 +71,11 @@ out the project. You can then try out URLs.
 The server doesn't reload code changes automatically (PRs accepted!) so
 make sure to hit CTRL-C and restart the server to try a code change out.
 
-
 Adding Support for a new URL
 ----------------------------
 
   1. Check if the site supports [oEmbed](http://oembed.com/) or [Open Graph](https://developers.facebook.com/docs/opengraph/).
-     If it does, you can probably get away with just whitelisting the URL in `Onebox::Engine::WhitelistedGenericOnebox` (see: [Whitelisted Generic Onebox caveats](#user-content-whitelisted-generic-onebox-caveats)).
+     If it does, you can probably get away with just allowing the URL in `Onebox::Engine::AllowlistedGenericOnebox` (see: [Allowlisted Generic Onebox caveats](#user-content-allowlisted-generic-onebox-caveats)).
      If the site does not support open standards, you can create a new engine.
 
   2. Create new onebox engine
@@ -164,16 +163,23 @@ Adding Support for a new URL
      require_relative "engine/name_onebox"
      ```
 
-
-Whitelisted Generic Onebox caveats
+Allowlisted Generic Onebox caveats
 ----------------------------------
 
-The Whitelisted Generic Onebox has some caveats for its use, beyond simply whitelisting the domain.
+The Allowlisted Generic Onebox has some caveats for its use, beyond simply allowlisting the domain.
 
-  1. The domain must be whitelisted
+  1. The domain must be allowlisted
   2. The URL you're oneboxing cannot be a root url (e.g. `http://example.com` won't work, but `http://example.com/page` will)
   3. If the oneboxed URL responds with oEmbed and has a `rich` type: the `html` content must contain an `<iframe>`. Responses without an iframe will not be oneboxed.
 
+Ignoring Canonical URLs
+-----------------------
+
+Onebox prefers to use canonical URLs instead of the raw inputted URL when searching for Open Graph metadata. If your site's canonical URL does not have opengraph metadata, use the `og:ignore_canonical` property to have Onebox ignore the canonical URL.
+
+```html
+<meta property="og:ignore_canonical" content="true" />
+```
 
 Installing
 ----------

data/lib/onebox/engine.rb

@@ -12,6 +12,22 @@ module Onebox
       end.map(&method(:const_get))
     end
 
+    def self.all_iframe_origins
+      engines.flat_map { |e| e.iframe_origins }.uniq.compact
+    end
+
+    def self.origins_to_regexes(origins)
+      return /.*/ if origins.include?("*")
+      origins.map do |origin|
+        escaped_origin = Regexp.escape(origin)
+        if origin.start_with?("*.", "https://*.", "http://*.")
+          escaped_origin = escaped_origin.sub("\\*", '\S*')
+        end
+
+        Regexp.new("\\A#{escaped_origin}", 'i')
+      end
+    end
+
     attr_reader :url, :uri
     attr_reader :timeout
 
@@ -100,6 +116,14 @@ module Onebox
         class_variable_set :@@matcher, r
       end
 
+      def requires_iframe_origins(*origins)
+        class_variable_set :@@iframe_origins, origins
+      end
+
+      def iframe_origins
+        class_variable_defined?(:@@iframe_origins) ? class_variable_get(:@@iframe_origins) : []
+      end
+
       # calculates a name for onebox using the class name of engine
       def onebox_name
         name.split("::").last.downcase.gsub(/onebox/, "")
@@ -141,7 +165,7 @@ require_relative "engine/wikimedia_onebox"
 require_relative "engine/wikipedia_onebox"
 require_relative "engine/youtube_onebox"
 require_relative "engine/youku_onebox"
-require_relative "engine/whitelisted_generic_onebox"
+require_relative "engine/allowlisted_generic_onebox"
 require_relative "engine/pubmed_onebox"
 require_relative "engine/soundcloud_onebox"
 require_relative "engine/imgur_onebox"
@@ -168,7 +192,6 @@ require_relative "engine/twitch_clips_onebox"
 require_relative "engine/twitch_stream_onebox"
 require_relative "engine/twitch_video_onebox"
 require_relative "engine/trello_onebox"
-require_relative "engine/wechat_mp_onebox"
 require_relative "engine/cloudapp_onebox"
 require_relative "engine/wistia_onebox"
 require_relative "engine/simplecast_onebox"

data/lib/onebox/engine/{whitelisted_generic_onebox.rb → allowlisted_generic_onebox.rb}

@@ -4,20 +4,24 @@ require 'htmlentities'
 
 module Onebox
   module Engine
-    class WhitelistedGenericOnebox
+    class AllowlistedGenericOnebox
       include Engine
       include StandardEmbed
       include LayoutSupport
 
-      def self.whitelist=(list)
-        @whitelist = list
+      def self.priority
+        200
       end
 
-      def self.whitelist
-        @whitelist ||= default_whitelist.dup
+      def self.allowed_domains=(list)
+        @allowed_domains = list
       end
 
-      def self.default_whitelist
+      def self.allowed_domains
+        @allowed_domains ||= default_allowed_domains.dup
+      end
+
+      def self.default_allowed_domains
         %w(
           23hq.com
           500px.com
@@ -176,13 +180,13 @@ module Onebox
         !!(uri.path =~ /\d{4}\/\d{2}\//)
       end
 
-      def self.twitter_label_whitelist
+      def self.allowed_twitter_labels
         ['brand', 'price', 'usd', 'cad', 'reading time', 'likes']
       end
 
       def self.===(other)
         other.kind_of?(URI) ?
-          host_matches(other, whitelist) || probable_wordpress(other) || probable_discourse(other) :
+          host_matches(other, allowed_domains) || probable_wordpress(other) || probable_discourse(other) :
           super
       end
 
@@ -233,11 +237,11 @@ module Onebox
           end
 
           # Twitter labels
-          if !Onebox::Helpers.blank?(d[:label1]) && !Onebox::Helpers.blank?(d[:data1]) && !!WhitelistedGenericOnebox.twitter_label_whitelist.find { |l| d[:label1] =~ /#{l}/i }
+          if !Onebox::Helpers.blank?(d[:label1]) && !Onebox::Helpers.blank?(d[:data1]) && !!AllowlistedGenericOnebox.allowed_twitter_labels.find { |l| d[:label1] =~ /#{l}/i }
             d[:label_1] = Onebox::Helpers.truncate(d[:label1])
             d[:data_1]  = Onebox::Helpers.truncate(d[:data1])
           end
-          if !Onebox::Helpers.blank?(d[:label2]) && !Onebox::Helpers.blank?(d[:data2]) && !!WhitelistedGenericOnebox.twitter_label_whitelist.find { |l| d[:label2] =~ /#{l}/i }
+          if !Onebox::Helpers.blank?(d[:label2]) && !Onebox::Helpers.blank?(d[:data2]) && !!AllowlistedGenericOnebox.allowed_twitter_labels.find { |l| d[:label2] =~ /#{l}/i }
             unless Onebox::Helpers.blank?(d[:label_1])
               d[:label_2] = Onebox::Helpers.truncate(d[:label2])
               d[:data_2]  = Onebox::Helpers.truncate(d[:data2])
@@ -261,7 +265,7 @@ module Onebox
       def rewrite_https(html)
         return unless html
         uri = URI(@url)
-        if WhitelistedGenericOnebox.host_matches(uri, WhitelistedGenericOnebox.rewrites)
+        if AllowlistedGenericOnebox.host_matches(uri, AllowlistedGenericOnebox.rewrites)
           html = html.gsub("http://", "https://")
         end
         html
@@ -277,7 +281,9 @@ module Onebox
       end
 
       def is_card?
-        data[:card] == 'player' && data[:player] =~ URI::regexp
+        data[:card] == 'player' &&
+          data[:player] =~ URI::regexp &&
+          options[:allowed_iframe_regexes]&.any? { |r| data[:player] =~ r }
       end
 
       def is_article?
@@ -301,16 +307,19 @@ module Onebox
       end
 
       def is_video?
-        data[:type] =~ /^video[\/\.]/ && !Onebox::Helpers.blank?(data[:video])
+        data[:type] =~ /^video[\/\.]/ &&
+          data[:video_type] == "video/mp4" && # Many sites include 'videos' with text/html types (i.e. iframes)
+          !Onebox::Helpers.blank?(data[:video])
       end
 
       def is_embedded?
-        data[:html] &&
-        data[:height] &&
-        (
-          data[:html]["iframe"] ||
-          WhitelistedGenericOnebox.html_providers.include?(data[:provider_name])
-        )
+        return false unless data[:html] && data[:height]
+        return true if AllowlistedGenericOnebox.html_providers.include?(data[:provider_name])
+        return false unless data[:html]["iframe"]
+
+        fragment = Nokogiri::HTML::fragment(data[:html])
+        src = fragment.at_css('iframe')&.[]("src")
+        options[:allowed_iframe_regexes]&.any? { |r| src =~ r }
       end
 
       def card_html

data/lib/onebox/engine/audio_onebox.rb

@@ -8,7 +8,7 @@ module Onebox
       matches_regexp(/^(https?:)?\/\/.*\.(mp3|ogg|opus|wav|m4a)(\?.*)?$/i)
 
       def always_https?
-        WhitelistedGenericOnebox.host_matches(uri, WhitelistedGenericOnebox.https_hosts)
+        AllowlistedGenericOnebox.host_matches(uri, AllowlistedGenericOnebox.https_hosts)
       end
 
       def to_html

data/lib/onebox/engine/bandcamp_onebox.rb

@@ -8,6 +8,7 @@ module Onebox
 
       matches_regexp(/^https?:\/\/.*\.bandcamp\.com\/(album|track)\//)
       always_https
+      requires_iframe_origins "https://bandcamp.com"
 
       def placeholder_html
         og = get_opengraph

data/lib/onebox/engine/facebook_media_onebox.rb

@@ -8,6 +8,7 @@ module Onebox
 
       matches_regexp(/^https?:\/\/.*\.facebook\.com\/(\w+)\/(videos|\?).*/)
       always_https
+      requires_iframe_origins "https://www.facebook.com"
 
       def to_html
         metadata = get_twitter
@@ -22,7 +23,7 @@ module Onebox
             </iframe>
           HTML
         else
-          html = Onebox::Engine::WhitelistedGenericOnebox.new(@url, @timeout).to_html
+          html = Onebox::Engine::AllowlistedGenericOnebox.new(@url, @timeout).to_html
           return if Onebox::Helpers.blank?(html)
           html
         end

data/lib/onebox/engine/gfycat_onebox.rb

@@ -10,7 +10,7 @@ module Onebox
       always_https
 
       def self.priority
-        # This engine should have priority over WhitelistedGenericOnebox.
+        # This engine should have priority over AllowlistedGenericOnebox.
         1
       end
 

data/lib/onebox/engine/google_calendar_onebox.rb

@@ -7,6 +7,7 @@ module Onebox
 
       matches_regexp /^(https?:)?\/\/((www|calendar)\.google\.[\w.]{2,}|goo\.gl)\/calendar\/.+$/
       always_https
+      requires_iframe_origins "https://calendar.google.com"
 
       def to_html
         url = @url.split('&').first

data/lib/onebox/engine/google_maps_onebox.rb

@@ -23,6 +23,8 @@ module Onebox
 
       always_https
 
+      requires_iframe_origins("https://maps.google.com", "https://google.com")
+
       # Matches shortened Google Maps URLs
       matches_regexp :short,      %r"^(https?:)?//goo\.gl/maps/"
 

data/lib/onebox/engine/image_onebox.rb

@@ -8,7 +8,7 @@ module Onebox
       matches_regexp(/^(https?:)?\/\/.+\.(png|jpg|jpeg|gif|bmp|tif|tiff)(\?.*)?$/i)
 
       def always_https?
-        WhitelistedGenericOnebox.host_matches(uri, WhitelistedGenericOnebox.https_hosts)
+        AllowlistedGenericOnebox.host_matches(uri, AllowlistedGenericOnebox.https_hosts)
       end
 
       def to_html

data/lib/onebox/engine/kaltura_onebox.rb

@@ -8,6 +8,7 @@ module Onebox
 
       always_https
       matches_regexp(/^https?:\/\/[a-z0-9]+\.kaltura\.com\/id\/[a-zA-Z0-9]+/)
+      requires_iframe_origins "https://*.kaltura.com"
 
       def preview_html
         og = get_opengraph

data/lib/onebox/engine/reddit_media_onebox.rb

@@ -45,7 +45,7 @@ module Onebox
             </aside>
           HTML
         else
-          html = Onebox::Engine::WhitelistedGenericOnebox.new(@url, @timeout).to_html
+          html = Onebox::Engine::AllowlistedGenericOnebox.new(@url, @timeout).to_html
           return if Onebox::Helpers.blank?(html)
           html
         end

data/lib/onebox/engine/sketchfab_onebox.rb

@@ -8,6 +8,7 @@ module Onebox
 
       matches_regexp(/^https?:\/\/sketchfab\.com\/(?:models\/|3d-models\/(?:[^\/\s]+-)?)([a-z0-9]{32})/)
       always_https
+      requires_iframe_origins("https://sketchfab.com")
 
       def to_html
         og = get_opengraph

data/lib/onebox/engine/slides_onebox.rb

@@ -7,10 +7,11 @@ module Onebox
       include StandardEmbed
 
       matches_regexp(/^https?:\/\/slides\.com\/[\p{Alnum}_\-]+\/[\p{Alnum}_\-]+$/)
+      requires_iframe_origins "https://slides.com"
 
       def to_html
         <<-HTML
-          <iframe src="//slides.com#{uri.path}/embed?style=light"
+          <iframe src="https://slides.com#{uri.path}/embed?style=light"
                   width="576"
                   height="420"
                   scrolling="no"

data/lib/onebox/engine/soundcloud_onebox.rb

@@ -7,6 +7,7 @@ module Onebox
       include StandardEmbed
 
       matches_regexp(/^https?:\/\/soundcloud\.com/)
+      requires_iframe_origins "https://w.soundcloud.com"
       always_https
 
       def to_html

data/lib/onebox/engine/standard_embed.rb

@@ -2,6 +2,7 @@
 
 require "cgi"
 require "onebox/open_graph"
+require 'onebox/oembed'
 
 module Onebox
   module Engine
@@ -32,7 +33,7 @@ module Onebox
       add_oembed_provider(/nytimes\.com\//, 'https://www.nytimes.com/svc/oembed/json/')
 
       def always_https?
-        WhitelistedGenericOnebox.host_matches(uri, WhitelistedGenericOnebox.https_hosts) || super
+        AllowlistedGenericOnebox.host_matches(uri, AllowlistedGenericOnebox.https_hosts) || super
       end
 
       def raw

data/lib/onebox/engine/steam_store_onebox.rb

@@ -8,6 +8,7 @@ module Onebox
 
       always_https
       matches_regexp(/^https?:\/\/store\.steampowered\.com\/app\/\d+/)
+      requires_iframe_origins "https://store.steampowered.com"
 
       def placeholder_html
         og = get_opengraph

data/lib/onebox/engine/trello_onebox.rb

@@ -7,6 +7,7 @@ module Onebox
       include StandardEmbed
 
       matches_regexp(/^https:\/\/trello\.com\/[bc]\/\W*/)
+      requires_iframe_origins "https://trello.com"
       always_https
 
       def to_html

data/lib/onebox/engine/twitch_clips_onebox.rb

@@ -9,6 +9,8 @@ class Onebox::Engine::TwitchClipsOnebox
   end
   include Onebox::Mixins::TwitchOnebox
 
+  requires_iframe_origins "https://clips.twitch.tv"
+
   def query_params
     "clip=#{twitch_id}"
   end

data/lib/onebox/engine/typeform_onebox.rb

@@ -6,6 +6,7 @@ module Onebox
       include Engine
 
       matches_regexp(/^https?:\/\/[a-z0-9\-_]+\.typeform\.com\/to\/[a-zA-Z0-9]+/)
+      requires_iframe_origins "https://*.typeform.com"
       always_https
 
       def to_html

data/lib/onebox/engine/video_onebox.rb

@@ -8,7 +8,7 @@ module Onebox
       matches_regexp(/^(https?:)?\/\/.*\.(mov|mp4|webm|ogv)(\?.*)?$/i)
 
       def always_https?
-        WhitelistedGenericOnebox.host_matches(uri, WhitelistedGenericOnebox.https_hosts)
+        AllowlistedGenericOnebox.host_matches(uri, AllowlistedGenericOnebox.https_hosts)
       end
 
       def to_html

data/lib/onebox/engine/vimeo_onebox.rb

@@ -7,6 +7,7 @@ module Onebox
       include StandardEmbed
 
       matches_regexp(/^https?:\/\/(www\.)?vimeo\.com\/\d+/)
+      requires_iframe_origins "https://player.vimeo.com"
       always_https
 
       WIDTH  ||= 640

data/lib/onebox/engine/wistia_onebox.rb

@@ -7,6 +7,7 @@ module Onebox
       include StandardEmbed
 
       matches_regexp(/https?:\/\/(.+)?(wistia.com|wi.st)\/(medias|embed)\/.*/)
+      requires_iframe_origins "https://fast.wistia.com"
       always_https
 
       def to_html

data/lib/onebox/engine/youku_onebox.rb

@@ -7,6 +7,7 @@ module Onebox
       include HTML
 
       matches_regexp(/^(https?:\/\/)?([\da-z\.-]+)(youku.com\/)(.)+\/?$/)
+      requires_iframe_origins "https://player.youku.com"
 
       # Try to get the video ID. Works for URLs of the form:
       # * http://v.youku.com/v_show/id_XNjM3MzAxNzc2.html
@@ -19,7 +20,14 @@ module Onebox
       end
 
       def to_html
-        "<embed width='570' height='360' src='https://players.youku.com/player.php/sid/#{video_id}/v.swf' type='application/x-shockwave-flash'></embed>"
+        <<~HTML
+          <iframe src="https://player.youku.com/embed/#{video_id}"
+                  width="640"
+                  height="430"
+                  frameborder='0'
+                  allowfullscreen>
+          </iframe>
+        HTML
       end
 
       private

data/lib/onebox/engine/youtube_onebox.rb

@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-require 'onebox/oembed'
-
 module Onebox
   module Engine
     class YoutubeOnebox
@@ -9,16 +7,17 @@ module Onebox
       include StandardEmbed
 
       matches_regexp(/^https?:\/\/(?:www\.)?(?:m\.)?(?:youtube\.com|youtu\.be)\/.+$/)
+      requires_iframe_origins "https://www.youtube.com"
       always_https
 
       WIDTH  ||= 480
       HEIGHT ||= 360
 
       def placeholder_html
-        if video_id
-          "<img src='https://i.ytimg.com/vi/#{video_id}/hqdefault.jpg' width='#{WIDTH}' height='#{HEIGHT}' #{video_oembed_data.title_attr}>"
-        elsif list_id
-          "<img src='#{list_thumbnail_url}' width='#{WIDTH}' height='#{HEIGHT}' #{list_oembed_data.title_attr}>"
+        og = get_opengraph.data
+
+        if video_id || list_id
+          "<img src='#{og[:image]}' width='#{WIDTH}' height='#{HEIGHT}' title='#{og[:title]}'>"
         else
           to_html
         end
@@ -45,7 +44,7 @@ module Onebox
           HTML
         else
           # for channel pages
-          html = Onebox::Engine::WhitelistedGenericOnebox.new(@url, @timeout).to_html
+          html = Onebox::Engine::AllowlistedGenericOnebox.new(@url, @timeout).to_html
           return if Onebox::Helpers.blank?(html)
           html.gsub!(/['"]\/\//, "https://")
           html
@@ -53,7 +52,7 @@ module Onebox
       end
 
       def video_title
-        @video_title ||= video_oembed_data.title
+        @video_title ||= get_opengraph.data[:title]
       end
 
       private
@@ -81,29 +80,6 @@ module Onebox
         @list_id ||= params['list']
       end
 
-      def list_thumbnail_url
-        @list_thumbnail_url ||= begin
-          url = "https://www.youtube.com/oembed?format=json&url=https://www.youtube.com/playlist?list=#{list_id}"
-          response = Onebox::Helpers.fetch_response(url) rescue "{}"
-          data = Onebox::Oembed.new(response)
-          data.thumbnail_url
-        rescue
-          nil
-        end
-      end
-
-      def video_oembed_data
-        url = "https://www.youtube.com/oembed?format=json&url=https://www.youtube.com/watch?v=#{video_id}"
-        response = Onebox::Helpers.fetch_response(url) rescue "{}"
-        Onebox::Oembed.new(response)
-      end
-
-      def list_oembed_data
-        url = "https://www.youtube.com/oembed?format=json&url=https://www.youtube.com/playlist?list=#{list_id}"
-        response = Onebox::Helpers.fetch_response(url) rescue "{}"
-        Onebox::Oembed.new(response)
-      end
-
       def embed_params
         p = { 'feature' => 'oembed', 'wmode' => 'opaque' }
 

data/lib/onebox/matcher.rb

@@ -2,8 +2,9 @@
 
 module Onebox
   class Matcher
-    def initialize(link)
+    def initialize(link, options = {})
       @url = link
+      @options = options
     end
 
     def ordered_engines
@@ -16,9 +17,14 @@ module Onebox
       uri = URI(@url)
       return unless uri.port.nil? || Onebox.options.allowed_ports.include?(uri.port)
       return unless uri.scheme.nil? || Onebox.options.allowed_schemes.include?(uri.scheme)
-      ordered_engines.find { |engine| engine === uri }
+      ordered_engines.find { |engine| engine === uri && has_allowed_iframe_origins?(engine) }
     rescue URI::InvalidURIError
       nil
     end
+
+    def has_allowed_iframe_origins?(engine)
+      allowed_regexes = @options[:allowed_iframe_regexes] || []
+      engine.iframe_origins.all? { |o| allowed_regexes.any? { |r| o =~ r } }
+    end
   end
 end

data/lib/onebox/mixins/twitch_onebox.rb

@@ -7,6 +7,7 @@ module Onebox
       def self.included(klass)
         klass.include(Onebox::Engine)
         klass.matches_regexp(klass.twitch_regexp)
+        klass.requires_iframe_origins "https://player.twitch.tv"
         klass.include(InstanceMethods)
       end
 
@@ -25,7 +26,7 @@ module Onebox
 
         def to_html
           <<~HTML
-          <iframe src="//#{base_url}#{query_params}&parent=#{options[:hostname]}&autoplay=false" width="620" height="378" frameborder="0" style="overflow: hidden;" scrolling="no" allowfullscreen="allowfullscreen"></iframe>
+          <iframe src="https://#{base_url}#{query_params}&parent=#{options[:hostname]}&autoplay=false" width="620" height="378" frameborder="0" style="overflow: hidden;" scrolling="no" allowfullscreen="allowfullscreen"></iframe>
           HTML
         end
       end

data/lib/onebox/preview.rb

@@ -7,10 +7,14 @@ module Onebox
     client_exception = defined?(Net::HTTPClientException) ? Net::HTTPClientException : Net::HTTPServerException
     WEB_EXCEPTIONS ||= [client_exception, OpenURI::HTTPError, Timeout::Error, Net::HTTPError, Errno::ECONNREFUSED]
 
-    def initialize(link, parameters = Onebox.options)
+    def initialize(link, options = Onebox.options)
       @url = link
-      @options = parameters
-      @engine_class = Matcher.new(@url).oneboxed
+      @options = options.dup
+
+      allowed_origins = @options[:allowed_iframe_origins] || Onebox::Engine.all_iframe_origins
+      @options[:allowed_iframe_regexes] = Engine.origins_to_regexes(allowed_origins)
+
+      @engine_class = Matcher.new(@url, @options).oneboxed
     end
 
     def to_s
@@ -63,7 +67,10 @@ module Onebox
     end
 
     def sanitize(html)
-      Sanitize.fragment(html, @options[:sanitize_config] || Sanitize::Config::ONEBOX)
+      config = @options[:sanitize_config] || Sanitize::Config::ONEBOX
+      config = config.merge(allowed_iframe_regexes: @options[:allowed_iframe_regexes])
+
+      Sanitize.fragment(html, config)
     end
 
     def engine

data/lib/onebox/sanitize_config.rb

@@ -12,9 +12,9 @@ class Sanitize
         'a' => RELAXED[:attributes]['a'] + %w(target),
         'audio' => %w[controls],
         'embed' => %w[height src type width],
-        'iframe' => %w[allowfullscreen frameborder height scrolling src width data-original-href],
+        'iframe' => %w[allowfullscreen frameborder height scrolling src width data-original-href data-unsanitized-src],
         'source' => %w[src type],
-        'video' => %w[controls height loop width autoplay muted poster],
+        'video' => %w[controls height loop width autoplay muted poster controlslist playsinline],
         'path' => %w[d],
         'svg' => ['aria-hidden', 'width', 'height', 'viewbox'],
         'div' => [:data], # any data-* attributes,
@@ -39,6 +39,22 @@ class Sanitize
           else
             a_tag.remove_attribute('target')
           end
+        end,
+
+        lambda do |env|
+          next unless env[:node_name] == 'iframe'
+
+          iframe = env[:node]
+          allowed_regexes = env[:config][:allowed_iframe_regexes] || [/.*/]
+
+          allowed = allowed_regexes.any? { |r| iframe["src"] =~ r }
+
+          if !allowed
+            # add a data attribute with the blocked src. This is not required
+            # but makes it much easier to troubleshoot onebox issues
+            iframe["data-unsanitized-src"] = iframe["src"]
+            iframe.remove_attribute("src")
+          end
         end
       ],
 

data/lib/onebox/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Onebox
-  VERSION = "1.9.30"
+  VERSION = "2.1.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: onebox
 version: !ruby/object:Gem::Version
-  version: 1.9.30
+  version: 2.1.1
 platform: ruby
 authors:
 - Joanna Zeta
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-07-07 00:00:00.000000000 Z
+date: 2020-08-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: addressable
@@ -300,6 +300,7 @@ files:
 - Rakefile
 - lib/onebox.rb
 - lib/onebox/engine.rb
+- lib/onebox/engine/allowlisted_generic_onebox.rb
 - lib/onebox/engine/amazon_onebox.rb
 - lib/onebox/engine/asciinema_onebox.rb
 - lib/onebox/engine/audio_onebox.rb
@@ -353,8 +354,6 @@ files:
 - lib/onebox/engine/typeform_onebox.rb
 - lib/onebox/engine/video_onebox.rb
 - lib/onebox/engine/vimeo_onebox.rb
-- lib/onebox/engine/wechat_mp_onebox.rb
-- lib/onebox/engine/whitelisted_generic_onebox.rb
 - lib/onebox/engine/wikimedia_onebox.rb
 - lib/onebox/engine/wikipedia_onebox.rb
 - lib/onebox/engine/wistia_onebox.rb
@@ -380,6 +379,7 @@ files:
 - lib/onebox/web_helpers.rb
 - onebox.gemspec
 - templates/_layout.mustache
+- templates/allowlistedgeneric.mustache
 - templates/amazon.mustache
 - templates/githubblob.mustache
 - templates/githubcommit.mustache
@@ -396,8 +396,6 @@ files:
 - templates/pubmed.mustache
 - templates/stackexchange.mustache
 - templates/twitterstatus.mustache
-- templates/wechatmp.mustache
-- templates/whitelistedgeneric.mustache
 - templates/wikimedia.mustache
 - templates/wikipedia.mustache
 - templates/xkcd.mustache

data/lib/onebox/engine/wechat_mp_onebox.rb

@@ -1,62 +0,0 @@
-# frozen_string_literal: true
-
-module Onebox
-  module Engine
-    class WechatMpOnebox
-      include Engine
-      include LayoutSupport
-      include HTML
-
-      always_https
-      matches_regexp(/^https?:\/\/mp\.weixin\.qq\.com\/s.*$/)
-
-      def tld
-        @tld || @@matcher.match(@url)["tld"]
-      end
-
-      def http_params
-        {
-          'User-Agent' => 'Mozilla/5.0 (iPhone; CPU iPhone OS 5_0_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9A405 Safari/7534.48.3',
-          'Accept-Encoding' => 'plain'
-        }
-      end
-
-      private
-
-      def extract_script_value(var_name)
-        if (script_elem = raw.css("script").select { |script| script.inner_text.include? "var #{var_name} = " }) && script_elem.any?
-          e = Nokogiri::HTML(script_elem[0].inner_text.match(/var\s+#{Regexp.quote(var_name)}\s+=\s+"(.*?)";/)[1])
-          CGI::unescapeHTML(e.text.scan(/(?:\\x([a-f0-9]{2}))|(.)/i).map { |x| x[0] ? [x[0].to_i(16)].pack('U') : x[1] }.join)
-        end
-      end
-
-      # TODO need to handle hotlink protection from wechat
-      def image
-        if banner_image = extract_script_value("msg_cdn_url")
-          return banner_image
-        end
-
-        if (main_image = raw.css("img").select { |img| not img['class'] }) && main_image.any?
-          attributes = main_image.first.attributes
-
-          return attributes["data-src"].to_s if attributes["data-src"]
-        end
-      end
-
-      def data
-        title = CGI.unescapeHTML(raw.css("title").inner_text)
-        by_info = CGI.unescapeHTML(raw.css("span.rich_media_meta_text.rich_media_meta_nickname").inner_text)
-
-        result = {
-          link: extract_script_value("msg_link") || link,
-          title: title,
-          image: image,
-          description: extract_script_value("msg_desc"),
-          by_info: by_info
-        }
-
-        result
-      end
-    end
-  end
-end

data/templates/wechatmp.mustache

@@ -1,4 +0,0 @@
-<h3><a href='{{link}}' target='_blank' rel='noopener'>{{title}}</a></h3>
-{{#by_info}}<b>{{by_info}}</b>{{/by_info}}
-<p>{{description}}</p>
-