onebox 1.7.3 → 1.7.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 67ec2675eb6687bee752534aef6d1e610545717b
-  data.tar.gz: cd82452275130c85076cb9078f25650ac9c73444
+  metadata.gz: 31e3e276aeb010031132237bf3e98b6b75901de0
+  data.tar.gz: 1619ea75ad1e8b795b6a932f6b2deabdcbb51f73
 SHA512:
-  metadata.gz: 557f8fbdfd7e33e247b5cd82ffc89f1484b57ba075e6c1ea412382be1e846c9aaa08e14777dec3799b5ce76dc61881a01909665087b21c4bd1775aa84f18f65b
-  data.tar.gz: 77c61683b419f729ba6d3b506b8c3bd960ae40f5b52662fb8d6e150605caea7f33e83c8aac7a3fdf9f82f4d1c92c045a571e7df2d5633c4457691e0067b735ae
+  metadata.gz: 4e2b1ef745998ec0cb12dee9b7454e19b834fc9fa7b895c95e8b4bb17b18926abbf1cbae6ce77d9d36a8440ab8bd460a070514f31aa4d56fd0c9a660a3c72eb4
+  data.tar.gz: d3ee07279fede7a2ef9dd8ebbd9410d19434c002a113950797a01afb1ae6690a12835bea7525ee358bcfc8a7f9f22ceb2dbfe4d2fa213c2a0b50da8cd592cd61

data/lib/onebox/engine.rb

@@ -42,8 +42,8 @@ module Onebox
       @timeout = timeout || Onebox.options.timeout
     end
 
-    # raises error if not defined in onebox engine. This is the output method for
-    # an engine.
+    # raises error if not defined in onebox engine.
+    # This is the output method for an engine.
     def to_html
       fail NoMethodError, "Engines need to implement this method"
     end

data/lib/onebox/engine/audio_onebox.rb

@@ -10,8 +10,14 @@ module Onebox
       end
 
       def to_html
-        url = ::Onebox::Helpers.normalize_url_for_output(@url)
-        "<audio controls><source src='#{url}'><a href='#{url}'>#{url}</a></audio>"
+        escaped_url = ::Onebox::Helpers.normalize_url_for_output(@url)
+
+        <<-HTML
+          <audio controls>
+            <source src="#{escaped_url}">
+            <a href="#{escaped_url}">#{@url}</a>
+          </audio>
+        HTML
       end
     end
   end

data/lib/onebox/engine/audioboom_onebox.rb

@@ -9,11 +9,10 @@ module Onebox
 
       def placeholder_html
         oembed = get_oembed
-
-        # we want the image to have the same dimensions as the embedded html
+        escaped_src = ::Onebox::Helpers.normalize_url_for_output(oembed[:thumbnail_url])
 
         <<-HTML
-          <img src="#{oembed[:thumbnail_url]}" style="max-width: #{oembed[:width]}px; max-height: #{oembed[:height]}px;" #{Helpers.title_attr(oembed)}>
+          <img src="#{escaped_src}" style="max-width: #{oembed[:width]}px; max-height: #{oembed[:height]}px;" #{Helpers.title_attr(oembed)}>
         HTML
       end
 

data/lib/onebox/engine/bandcamp_onebox.rb

@@ -9,15 +9,17 @@ module Onebox
 
       def placeholder_html
         og = get_opengraph
-        "<img src='#{og[:image]}' height='#{og[:video_height]}' #{Helpers.title_attr(og)}>"
+        escaped_src = ::Onebox::Helpers.normalize_url_for_output(og[:image])
+        "<img src='#{escaped_src}' height='#{og[:video_height]}' #{Helpers.title_attr(og)}>"
       end
 
       def to_html
         og = get_opengraph
         src = og[:video_secure_url] || og[:video]
+        escaped_src = ::Onebox::Helpers.normalize_url_for_output(src)
 
         <<-HTML
-          <iframe src="#{src}"
+          <iframe src="#{escaped_src}"
                   width="#{og[:video_width]}"
                   height="#{og[:video_height]}"
                   scrolling="no"

data/lib/onebox/engine/coub_onebox.rb

@@ -9,7 +9,8 @@ module Onebox
 
       def placeholder_html
         oembed = get_oembed
-        "<img src='#{oembed[:thumbnail_url]}' height='#{oembed[:thumbnail_height]}' width='#{oembed[:thumbnail_width]}' #{Helpers.title_attr(oembed)}>"
+        escaped_src = ::Onebox::Helpers.normalize_url_for_output(oembed[:thumbnail_url])
+        "<img src='#{escaped_src}' height='#{oembed[:thumbnail_height]}' width='#{oembed[:thumbnail_width]}' #{Helpers.title_attr(oembed)}>"
       end
 
       def to_html

data/lib/onebox/engine/douban_onebox.rb

@@ -9,14 +9,15 @@ module Onebox
 
       private
 
-      def data
-        {   
-          link: link,
-          title: raw.css('title').text.gsub("\n",'').strip(),
-          image: raw.css('img[rel*="v:"]').first['src'],
-          description: raw.css('meta[name=description]').first['content'],
-        }   
-      end 
-    end 
-  end 
+        def data
+          {
+            link: link,
+            title: raw.css('title').text.gsub("\n",'').strip(),
+            image: raw.css('img[rel*="v:"]').first['src'],
+            description: raw.css('meta[name=description]').first['content'],
+          }
+        end
+
+    end
+  end
 end

data/lib/onebox/engine/five_hundred_px_onebox.rb

@@ -9,7 +9,8 @@ module Onebox
 
       def to_html
         og = get_opengraph
-        "<img src='#{og[:image]}' width='#{og[:image_width]}' height='#{og[:image_height]}' #{Helpers.title_attr(og)}>"
+        escaped_src = ::Onebox::Helpers.normalize_url_for_output(og[:image])
+        "<img src='#{escaped_src}' width='#{og[:image_width]}' height='#{og[:image_height]}' #{Helpers.title_attr(og)}>"
       end
 
     end

data/lib/onebox/engine/flickr_onebox.rb

@@ -9,7 +9,8 @@ module Onebox
 
       def to_html
         og = get_opengraph
-        "<img src='#{og[:image]}' width='#{og[:image_width]}' height='#{og[:image_height]}' #{Helpers.title_attr(og)}>"
+        escaped_src = ::Onebox::Helpers.normalize_url_for_output(og[:image])
+        "<img src='#{escaped_src}' width='#{og[:image_width]}' height='#{og[:image_height]}' #{Helpers.title_attr(og)}>"
       end
 
     end

data/lib/onebox/engine/gfycat_onebox.rb

@@ -10,9 +10,10 @@ module Onebox
       def to_html
         oembed = get_oembed
         src = Nokogiri::HTML::fragment(oembed[:html]).at_css("iframe")["src"]
+        escaped_src = ::Onebox::Helpers.normalize_url_for_output(src)
 
         <<-HTML
-          <iframe src="#{src}"
+          <iframe src="#{escaped_src}"
                   width="#{oembed[:width]}"
                   height="#{oembed[:height]}"
                   scrolling="no"
@@ -23,10 +24,11 @@ module Onebox
       end
 
       def placeholder_html
-        opengraph = get_opengraph
+        og = get_opengraph
+        escaped_src = ::Onebox::Helpers.normalize_url_for_output(og[:image])
 
         <<-HTML
-          <img src="#{opengraph[:image]}" width=""#{opengraph[:image_width]}" height=""#{opengraph[:image_height]}">
+          <img src="#{escaped_src}" width="#{og[:image_width]}" height="#{og[:image_height]}">
         HTML
       end
 

data/lib/onebox/engine/giphy_onebox.rb

@@ -9,10 +9,12 @@ module Onebox
 
       def to_html
         oembed = get_oembed
+        escaped_url = ::Onebox::Helpers.normalize_url_for_output(oembed[:url])
+        escaped_src = ::Onebox::Helpers.normalize_url_for_output(oembed[:image])
 
         <<-HTML
-          <a href="#{oembed[:url]}" target="_blank">
-            <img src="#{oembed[:image]}" width="#{oembed[:width]}" height="#{oembed[:height]}" #{Helpers.title_attr(oembed)}>
+          <a href="#{escaped_url}" target="_blank">
+            <img src="#{escaped_src}" width="#{oembed[:width]}" height="#{oembed[:height]}" #{Helpers.title_attr(oembed)}>
           </a>
         HTML
       end

data/lib/onebox/engine/google_calendar_onebox.rb

@@ -8,18 +8,22 @@ module Onebox
 
       def to_html
         url = @url.split('&').first
-        "<iframe src='#{url}&rm=minimal' style='border: 0' width='800' height='600' frameborder='0' scrolling='no'>#{placeholder_html}</iframe>"
+        escaped_src = ::Onebox::Helpers.normalize_url_for_output(url)
+        "<iframe src='#{src}&rm=minimal' style='border: 0' width='800' height='600' frameborder='0' scrolling='no'>#{placeholder_html}</iframe>"
       end
 
       def placeholder_html
-        <<HTML
-<div placeholder><div class='gdocs-onebox gdocs-onebox-splash' style='display:table-cell;vertical-align:middle;width:800px;height:600px'>
-<div style='text-align:center;'>
-<div class='gdocs-onebox-logo g-calendar-logo'></div>
-<p>Google Calendar</p>
-</div></div></div>
-HTML
+        <<-HTML
+          <div placeholder>
+            <div class='gdocs-onebox gdocs-onebox-splash' style='display:table-cell;vertical-align:middle;width:800px;height:600px'>
+              <div style='text-align:center;'>
+                <div class='gdocs-onebox-logo g-calendar-logo'></div>
+                <p>Google Calendar</p>
+              </div>
+            </div>
+          </div>
+        HTML
       end
     end
   end
-end
+end

data/lib/onebox/engine/google_maps_onebox.rb

@@ -52,9 +52,9 @@ module Onebox
       end
 
       def placeholder_html
-        width = @placeholder_width || 690
+        width  = @placeholder_width  || 690
         height = @placeholder_height || 400
-        "<img src=\"#{CGI.escapeHTML(@placeholder)}\" width=\"#{width}\" height=\"#{height}\"/>"
+        "<img src='#{@placeholder}' width='#{width}' height='#{height}'/>"
       end
 
       private

data/lib/onebox/engine/image_onebox.rb

@@ -11,12 +11,17 @@ module Onebox
 
       def to_html
         # Fix Dropbox image links
-        if /^https:\/\/www.dropbox.com\/s\//.match @url
-          @url.gsub!("https://www.dropbox.com","https://dl.dropboxusercontent.com")
+        if @url[/^https:\/\/www.dropbox.com\/s\//]
+          @url.sub!("https://www.dropbox.com", "https://dl.dropboxusercontent.com")
         end
 
-        escaped = Onebox::Helpers.normalize_url_for_output(url)
-        "<a href='#{escaped}' target='_blank'><img src='#{escaped}'></a>"
+        escaped_url = ::Onebox::Helpers.normalize_url_for_output(@url)
+
+        <<-HTML
+          <a href="#{escaped_url}" target="_blank">
+            <img src="#{escaped_url}">
+          </a>
+        HTML
       end
     end
   end

data/lib/onebox/engine/imgur_onebox.rb

@@ -8,46 +8,67 @@ module Onebox
       always_https
 
       def to_html
-        imgur_data = get_imgur_data
-        return "<video width='#{imgur_data[:"video:width"]}' height='#{imgur_data[:"video:height"]}' #{Helpers.title_attr(imgur_data)} controls autoplay loop><source src='#{imgur_data[:"video:secure_url"]}' type='video/mp4'><source src='#{imgur_data[:"video:secure_url"].gsub('mp4', 'webm')}' type='video/webm'></video>" if imgur_data[:"video:secure_url"]
-        return "<div class='onebox imgur-album'><a href='#{url}' target='_blank'><span class='outer-box' style='width:#{imgur_data[:"image:width"]}px'><span class='inner-box'><span class='album-title'>[Album] #{imgur_data[:title]}</span></span></span><img src='#{get_secure_link(imgur_data[:image])}' #{Helpers.title_attr(imgur_data)} height='#{imgur_data[:"image:height"]}' width='#{imgur_data[:"image:width"]}'></a></div>" if is_album?
-        return "<a href='#{url}' target='_blank'><img src='#{get_secure_link(imgur_data[:image])}' #{Helpers.title_attr(imgur_data)} alt='Imgur' height='#{imgur_data[:"image:height"]}' width='#{imgur_data[:"image:width"]}'></a>" if imgur_data[:image]
-        return nil
-      end
-
-      def placeholder_html
-        imgur_data = get_imgur_data
-        return "<video width='#{imgur_data[:"video:width"]}' height='#{imgur_data[:"video:height"]}' #{Helpers.title_attr(imgur_data)} controls autoplay loop><source src='#{imgur_data[:"video:secure_url"]}' type='video/mp4'><source src='#{imgur_data[:"video:secure_url"].gsub('mp4', 'webm')}' type='video/webm'></video>" if imgur_data[:"video:secure_url"]
-        return "<img src='#{get_secure_link(imgur_data[:image])}' #{Helpers.title_attr(imgur_data)} alt='Imgur' height='#{imgur_data[:"image:height"]}' width='#{imgur_data[:"image:width"]}'>"
-        return nil
+        og = get_opengraph
+        return video_html(og) if !Onebox::Helpers::blank?(og[:video_secure_url])
+        return album_html(og) if is_album?
+        return image_html(og) if !Onebox::Helpers::blank?(og[:image])
+        nil
       end
 
       private
-      def get_imgur_data
-        response = Onebox::Helpers.fetch_response(url)
-        html = Nokogiri::HTML(response.body)
-        imgur_data = {}
-        html.css('meta').each do |m|
-          if m.attribute('property') && m.attribute('property').to_s.match(/^og:/i)
-            m_content = m.attribute('content').to_s.strip
-            m_property = m.attribute('property').to_s.gsub('og:', '')
-            imgur_data[m_property.to_sym] = m_content
-          end
+
+        def video_html(og)
+          escaped_src = ::Onebox::Helpers.normalize_url_for_output(og[:video_secure_url])
+
+          <<-HTML
+            <video width='#{og[:video_width]}' height='#{og[:video_height]}' #{Helpers.title_attr(og)} controls loop>
+              <source src='#{escaped_src}' type='video/mp4'>
+              <source src='#{escaped_src.gsub('mp4', 'webm')}' type='video/webm'>
+            </video>
+          HTML
         end
-        return imgur_data
-      end
 
-      def is_album?
-        oembed_data = Onebox::Helpers.symbolize_keys(::MultiJson.load(Onebox::Helpers.fetch_response("http://api.imgur.com/oembed.json?url=#{url}").body))
-        imgur_data_id = Nokogiri::HTML(oembed_data[:html]).xpath("//blockquote").attr("data-id")
-        return !!(imgur_data_id.to_s =~ /a\//)
-      end
+        def album_html(og)
+          escaped_url = ::Onebox::Helpers.normalize_url_for_output(url)
+          escaped_src = ::Onebox::Helpers.normalize_url_for_output(get_secure_link(og[:image]))
+
+          <<-HTML
+            <div class='onebox imgur-album'>
+              <a href='#{escaped_url}' target='_blank'>
+                <span class='outer-box' style='width:#{og[:image_width]}px'>
+                  <span class='inner-box'>
+                    <span class='album-title'>[Album] #{og[:title]}</span>
+                  </span>
+                </span>
+                <img src='#{escaped_src}' #{Helpers.title_attr(og)} height='#{og[:image_height]}' width='#{og[:image_width]}'>
+              </a>
+            </div>
+          HTML
+        end
+
+        def is_album?
+          oembed_data = Onebox::Helpers.symbolize_keys(::MultiJson.load(Onebox::Helpers.fetch_response("http://api.imgur.com/oembed.json?url=#{url}").body))
+          imgur_data_id = Nokogiri::HTML(oembed_data[:html]).xpath("//blockquote").attr("data-id")
+          imgur_data_id.to_s[/a\//]
+        end
+
+        def image_html(og)
+          escaped_url = ::Onebox::Helpers.normalize_url_for_output(url)
+          escaped_src = ::Onebox::Helpers.normalize_url_for_output(get_secure_link(og[:image]))
+
+          <<-HTML
+            <a href='#{escaped_url}' target='_blank'>
+              <img src='#{escaped_src}' #{Helpers.title_attr(og)} alt='Imgur' height='#{og[:image_height]}' width='#{og[:image_width]}'>
+            </a>
+          HTML
+        end
+
+        def get_secure_link(link)
+          secure_link = URI(link)
+          secure_link.scheme = 'https'
+          secure_link.to_s
+        end
 
-      def get_secure_link(link)
-        secure_link = URI(link)
-        secure_link.scheme = 'https'
-        secure_link.to_s
-      end
     end
   end
 end

data/lib/onebox/engine/mixcloud_onebox.rb

@@ -9,7 +9,8 @@ module Onebox
 
       def placeholder_html
         oembed = get_oembed
-        "<img src='#{oembed[:image]}' height='#{oembed[:height]}' #{Helpers.title_attr(oembed)}>"
+        escaped_src = ::Onebox::Helpers.normalize_url_for_output(oembed[:image])
+        "<img src='#{escaped_src}' height='#{oembed[:height]}' #{Helpers.title_attr(oembed)}>"
       end
 
       def to_html

data/lib/onebox/engine/replit_onebox.rb

@@ -9,11 +9,10 @@ module Onebox
 
       def placeholder_html
         oembed = get_oembed
-
-        # we want the image to have the same dimensions as the embedded html
+        escaped_src = ::Onebox::Helpers.normalize_url_for_output(oembed[:thumbnail_url])
 
         <<-HTML
-          <img src="#{oembed[:thumbnail_url]}" style="max-width: #{oembed[:width]}px; max-height: #{oembed[:height]}px;" #{Helpers.title_attr(oembed)}>
+          <img src="#{escaped_src}" style="max-width: #{oembed[:width]}px; max-height: #{oembed[:height]}px;" #{Helpers.title_attr(oembed)}>
         HTML
       end
 

data/lib/onebox/engine/sketchfab_onebox.rb

@@ -11,9 +11,10 @@ module Onebox
         opengraph = get_opengraph
 
         src = opengraph[:video_url].gsub("?autostart=1", "")
+        escaped_src = ::Onebox::Helpers.normalize_url_for_output(src)
 
         <<-HTML
-          <iframe src="#{src}"
+          <iframe src="#{escaped_src}"
                   width="#{opengraph[:video_width]}"
                   height="#{opengraph[:video_height]}"
                   scrolling="no"
@@ -25,7 +26,8 @@ module Onebox
 
       def placeholder_html
         opengraph = get_opengraph
-        "<img src='#{opengraph[:image]}'>"
+        escaped_src = ::Onebox::Helpers.normalize_url_for_output(opengraph[:image])
+        "<img src='#{escaped_src}'>"
       end
 
     end

data/lib/onebox/engine/slides_onebox.rb

@@ -21,7 +21,8 @@ module Onebox
       end
 
       def placeholder_html
-        "<img src='#{raw[:image]}'>"
+        escaped_src = ::Onebox::Helpers.normalize_url_for_output(raw[:image])
+        "<img src='#{escaped_src}'>"
       end
 
     end

data/lib/onebox/engine/soundcloud_onebox.rb

@@ -13,7 +13,8 @@ module Onebox
 
       def placeholder_html
         return if Onebox::Helpers.blank?(oembed_data[:thumbnail_url])
-        "<img src='#{oembed_data[:thumbnail_url]}' #{Helpers.title_attr(oembed_data)}>"
+        escaped_src = ::Onebox::Helpers.normalize_url_for_output(oembed_data[:thumbnail_url])
+        "<img src='#{escaped_src}' #{Helpers.title_attr(oembed_data)}>"
       end
 
       private

data/lib/onebox/engine/standard_embed.rb

@@ -95,14 +95,14 @@ module Onebox
           html_doc.css('meta').each do |m|
             if (m["property"] && m["property"][/^og:(.+)$/i]) || (m["name"] && m["name"][/^og:(.+)$/i])
               value = (m["content"] || m["value"]).to_s
-              og[$1.tr('-:','_').to_sym] ||= CGI.escapeHTML(value) unless Onebox::Helpers::blank?(value)
+              og[$1.tr('-:','_').to_sym] ||= value unless Onebox::Helpers::blank?(value)
             end
           end
 
           # Attempt to retrieve the title from the meta tag
           title_element = html_doc.at_css('title')
           if title_element && title_element.text
-            og[:title] ||= CGI.escapeHTML(title_element.text) unless Onebox::Helpers.blank?(title_element.text)
+            og[:title] ||= title_element.text unless Onebox::Helpers.blank?(title_element.text)
           end
 
           og
@@ -116,7 +116,7 @@ module Onebox
           html_doc.css('meta').each do |m|
             if (m["property"] && m["property"][/^twitter:(.+)$/i]) || (m["name"] && m["name"][/^twitter:(.+)$/i])
               value = (m["content"] || m["value"]).to_s
-              twitter[$1.tr('-:','_').to_sym] ||= CGI.escapeHTML(value) unless Onebox::Helpers::blank?(value)
+              twitter[$1.tr('-:','_').to_sym] ||= value unless Onebox::Helpers::blank?(value)
             end
           end
 

data/lib/onebox/engine/steam_store_onebox.rb

@@ -9,11 +9,12 @@ module Onebox
 
       def placeholder_html
         og = get_opengraph
+        escaped_src = ::Onebox::Helpers.normalize_url_for_output(og[:image])
         <<-HTML
           <div style='width:100%; height:190px; background-color:#262626; color:#9e9e9e; margin:15px 0;'>
             <div style='padding:10px'>
               <h3 style='color:#fff; margin:10px 0 10px 5px;'>#{og[:title]}</h3>
-              <img src='#{og[:image]}' style='float:left; max-width:184px; margin:5px 15px 0 5px'/>
+              <img src='escaped_src' style='float:left; max-width:184px; margin:5px 15px 0 5px'/>
               <p>#{og[:description]}</p>
             </div>
           </div>
@@ -22,9 +23,10 @@ module Onebox
 
       def to_html
         iframe_url = @url.gsub('/app/', '/widget/')
+        escaped_src = ::Onebox::Helpers.normalize_url_for_output(iframe_url)
 
         <<-HTML
-          <iframe src='#{iframe_url}'
+          <iframe src='#{escaped_src}'
                   frameborder='0'
                   width='100%'
                   height='190'>

data/lib/onebox/engine/video_onebox.rb

@@ -10,8 +10,13 @@ module Onebox
       end
 
       def to_html
-        url = ::Onebox::Helpers.normalize_url_for_output(@url)
-        "<video width='100%' height='100%' controls><source src='#{url}'><a href='#{url}'>#{url}</a></video>"
+        escaped_url = ::Onebox::Helpers.normalize_url_for_output(@url)
+        <<-HTML
+          <video width='100%' height='100%' controls>
+            <source src='#{escaped_url}'>
+            <a href='#{escaped_url}'>#{@url}</a>
+          </video>
+        HTML
       end
     end
   end

data/lib/onebox/engine/vimeo_onebox.rb

@@ -9,7 +9,8 @@ module Onebox
 
       def placeholder_html
         oembed = get_oembed
-        "<img src='#{oembed[:thumbnail_url]}' width='#{oembed[:thumbnail_width]}' height='#{oembed[:thumbnail_height]}' #{Helpers.title_attr(oembed)}>"
+        escaped_src = ::Onebox::Helpers.normalize_url_for_output(oembed[:thumbnail_url])
+        "<img src='#{escaped_src}' width='#{oembed[:thumbnail_width]}' height='#{oembed[:thumbnail_height]}' #{Helpers.title_attr(oembed)}>"
       end
 
       def to_html

data/lib/onebox/engine/whitelisted_generic_onebox.rb

@@ -278,13 +278,18 @@ module Onebox
         def image_html
           return if Onebox::Helpers.blank?(data[:image])
 
+          escaped_src = ::Onebox::Helpers.normalize_url_for_output(data[:image])
+
           alt    = data[:description]  || data[:title]
           width  = data[:image_width]  || data[:thumbnail_width]  || data[:width]
           height = data[:image_height] || data[:thumbnail_height] || data[:height]
-          "<img src='#{data[:image]}' alt='#{alt}' width='#{width}' height='#{height}'>"
+
+          "<img src='#{escaped_src}' alt='#{alt}' width='#{width}' height='#{height}'>"
         end
 
         def video_html
+          escaped_src = ::Onebox::Helpers.normalize_url_for_output(data[:video])
+
           if data[:video_type] == "video/mp4"
             <<-HTML
               <video title='#{data[:title]}'
@@ -292,12 +297,12 @@ module Onebox
                      height='#{data[:video_height]}'
                      style='max-width:100%'
                      controls=''>
-                <source src='#{data[:video]}'>
+                <source src='#{escaped_src}'>
               </video>
             HTML
           else
             <<-HTML
-              <iframe src='#{data[:video]}'
+              <iframe src='#{escaped_src}'
                       title='#{data[:title]}'
                       width='#{data[:video_width]}'
                       height='#{data[:video_height]}'

data/lib/onebox/engine/youku_onebox.rb

@@ -11,28 +11,21 @@ module Onebox
       # * http://v.youku.com/v_show/id_XMTQ5MjgyMjMyOA==.html?from=y1.3-tech-index3-232-10183.89969-89963.3-1
       def video_id
         match = uri.path.match(/\/v_show\/id_([a-zA-Z0-9_=\-]+)(\.html)?.*/)
-        return match[1] if match && match[1]
-
-        nil
+        match && match[1]
       rescue
-        return nil
+        nil
       end
 
       def to_html
-        "<embed width='570' height='360' src='https://players.youku.com/player.php/sid/#{video_id}/v.swf' wmode='transparent' allowFullScreen='true' quality='high' align='middle' allowScriptAccess='always' type='application/x-shockwave-flash'></embed>"
-      end
-
-      def placeholder_html
-        to_html
+        "<embed width='570' height='360' src='https://players.youku.com/player.php/sid/#{video_id}/v.swf' type='application/x-shockwave-flash'></embed>"
       end
 
       private
 
-      # Note: May throw! Make sure to rescue.
       def uri
         @_uri ||= URI(@url)
       end
 
-    end 
-  end 
+    end
+  end
 end

data/lib/onebox/file_type_finder.rb

@@ -1,6 +1,6 @@
 module Onebox
   module FileTypeFinder
-  
+
     # In general, most of file extension names would be recognized
     # by Highlights.js.  However, some need to be checked in other
     # ways, either because they just aren't included, because they
@@ -19,7 +19,7 @@ module Onebox
       ".simplecov"       => "rb", # Not official, but seems commonly found
       ".sty"             => "tex"
     }
-    
+
     # Some extensionless files for which we know the type
     # These should all be stored LOWERCASE, just for consistency.
     # The ones that I know of also include the ".lock" fake extension.
@@ -28,7 +28,7 @@ module Onebox
     # FIRST by their types and THEN by their names.
     @extensionless_files = {
       "cmake.in"      => "cmake",
-      
+
       "gruntfile"     => "js",
       "gulpfile"      => "js",
 
@@ -43,7 +43,7 @@ module Onebox
       "rakefile"      => "rb",
       "thorfile"      => "rb",
       "vagrantfile"   => "rb",
-      
+
       "boxfile"       => "yaml" # Not currently (2014-11) in Highlight.js
     }
 
@@ -51,7 +51,7 @@ module Onebox
       lower_name = file_name.downcase
       # First check against the known lists of "special" files and extensions.
       return @extensionless_files[lower_name] if @extensionless_files.has_key?(lower_name)
-      
+
       @long_file_types.each { |extension,type|
         return type if lower_name.end_with?(extension)
       }
@@ -60,10 +60,10 @@ module Onebox
       # but add one so we don't return the "." itself.
       dot_spot = lower_name.rindex(".")
       return lower_name[(dot_spot+1)..-1] if dot_spot
-      
+
       # If we couldn't figure it out from the name,
       # let the highlighter figure it out from the content.
-      return ""
+      ""
     end
   end
 end

data/lib/onebox/helpers.rb

@@ -19,9 +19,8 @@ module Onebox
       raise Net::HTTPError.new('HTTP redirect too deep', location) if limit == 0
 
       uri = URI(location)
-      if !uri.host
-        uri = URI("#{domain}#{location}")
-      end
+      uri = URI("#{domain}#{location}") if !uri.host
+
       http = Net::HTTP.new(uri.host, uri.port)
       http.open_timeout = Onebox.options.connect_timeout
       http.read_timeout = Onebox.options.timeout
@@ -32,10 +31,10 @@ module Onebox
 
       response = http.request_get(uri.request_uri,headers)
 
-      cookie = response.get_fields('set-cookie')
-      if (cookie)
-        header = {'cookie' => cookie.join("")}
+      if cookie = response.get_fields('set-cookie')
+        header = { 'cookie' => cookie.join }
       end
+
       header = nil unless header.is_a? Hash
 
       case response
@@ -63,15 +62,16 @@ module Onebox
     end
 
     def self.title_attr(meta)
-      (meta && !blank?(meta[:title])) ? "title='#{CGI.escapeHTML(meta[:title])}'" : ""
+      (meta && !blank?(meta[:title])) ? "title='#{meta[:title]}'" : ""
     end
 
     def self.normalize_url_for_output(url)
+      return "" unless url
       url = url.dup
       # expect properly encoded url, remove any unsafe chars
       url.gsub!("'", "'")
       url.gsub!('"', """)
-      url.gsub!(/[^a-zA-Z0-9%\-`._~:\/?#\[\]@!$&'\(\)*+,;=]/, "")
+      url.gsub!(/[^\w\-`._~:\/?#\[\]@!$&'\(\)*+,;=]/, "")
       url
     end
 

data/lib/onebox/layout.rb

@@ -42,7 +42,7 @@ module Onebox
       end
 
       def link
-        record[:link]
+        ::Onebox::Helpers.normalize_url_for_output(record[:link])
       end
 
       def domain

data/lib/onebox/onebox_sanitize_config.rb

@@ -0,0 +1,24 @@
+class Sanitize
+  module Config
+
+    HTTP_PROTOCOLS ||= ['http', 'https', :relative].freeze
+
+    ONEBOX ||= freeze_config merge(RELAXED,
+      elements: RELAXED[:elements] + %w[audio embed iframe source video],
+
+      attributes: merge(RELAXED[:attributes],
+        'audio'  => %w[controls],
+        'embed'  => %w[height src type width],
+        'iframe' => %w[allowfullscreen frameborder height scrolling src width],
+        'source' => %w[src type],
+        'video'  => %w[controls height loop width],
+      ),
+
+      protocols: merge(RELAXED[:protocols],
+        'embed'  => { 'src' => HTTP_PROTOCOLS },
+        'iframe' => { 'src' => HTTP_PROTOCOLS },
+        'source' => { 'src' => HTTP_PROTOCOLS },
+      ),
+    )
+  end
+end

data/lib/onebox/preview.rb

@@ -1,3 +1,6 @@
+require "sanitize"
+require_relative "onebox_sanitize_config"
+
 module Onebox
   class Preview
     attr_reader :cache
@@ -11,14 +14,14 @@ module Onebox
 
     def to_s
       return "" unless engine
-      process_html(engine_html)
+      sanitize process_html engine_html
     rescue *Onebox::Preview.web_exceptions
       ""
     end
 
     def placeholder_html
       return "" unless engine
-      process_html(engine.placeholder_html)
+      sanitize process_html engine.placeholder_html
     rescue *Onebox::Preview.web_exceptions
       ""
     end
@@ -62,6 +65,10 @@ module Onebox
       html
     end
 
+    def sanitize(html)
+      Sanitize.fragment(html, Sanitize::Config::ONEBOX)
+    end
+
     def engine
       return nil unless @engine_class
       @engine ||= @engine_class.new(@url, cache)

data/lib/onebox/version.rb

@@ -1,3 +1,3 @@
 module Onebox
-  VERSION = "1.7.3"
+  VERSION = "1.7.4"
 end

data/onebox.gemspec

@@ -24,6 +24,7 @@ Gem::Specification.new do |spec|
   spec.add_runtime_dependency 'moneta', '~> 0.8'
   spec.add_runtime_dependency 'htmlentities', '~> 4.3.4'
   spec.add_runtime_dependency 'fast_blank', '>= 1.0.0'
+  spec.add_runtime_dependency 'sanitize'
 
   spec.add_development_dependency 'bundler', '~> 1.7'
   spec.add_development_dependency 'rake', '~> 10.4'

data/spec/lib/onebox/engine/audio_onebox_spec.rb

@@ -28,8 +28,4 @@ describe Onebox::Engine::AudioOnebox do
   it "includes a fallback direct link to the audio" do
     expect(Onebox.preview('http://kolber.github.io/audiojs/demos/mp3/juicy.mp3').to_s).to match(/<a.*mp3/)
   end
-
-  it "correctly escapes single quotes" do
-    expect(Onebox.preview("http://test.com/test'ing.mp3").to_s).not_to match(/test'ing/)
-  end
 end

data/spec/lib/onebox/engine/image_onebox_spec.rb

@@ -36,8 +36,4 @@ describe Onebox::Engine::ImageOnebox do
   it "includes a direct link to the image" do
     expect(Onebox.preview('http://www.discourse.org/images/logo.png').to_s).to match(/<a.*png/)
   end
-
-  it "doesn't inline single quotes" do
-    expect(Onebox.preview("http://host/path/to/Image'withquote.png").to_s).to match(/Image&apos;withquote/)
-  end
 end

data/spec/lib/onebox/engine_spec.rb

@@ -18,18 +18,12 @@ describe Onebox::Engine do
   end
 
   describe "#link" do
-    before { allow(Onebox::View).to receive(:template) { %|this shold be a template| } }
+    before { allow(Onebox::View).to receive(:template) { %|this should be a template| } }
 
     it "escapes `link`" do
       html = OneboxEngineExample.new(%|http://foo.com/'?a=1&b=2|).to_html
       expect(html).not_to match(/&(?!amp;)(?!#39;)/)
     end
-
-    it "escapes xss" do
-      skip 'this is checking the wrong thing'
-      html = OneboxEngineExample.new(%|http://foo.com/'?%20onmouseover=alert(/foo/)|).to_html
-      expect(html).not_to include(%|onmouseover=alert(/foo/)|)
-    end
   end
 
   describe "#record" do

data/spec/lib/onebox/preview_spec.rb

@@ -82,4 +82,19 @@ describe Onebox::Preview do
       expect(preview.send(:engine)).to be_an(Onebox::Engine)
     end
   end
+
+  describe "xss" do
+    let(:xss) { "wat' onerror='alert(/XSS/)" }
+    let(:img_html) { "<img src='#{xss}'>" }
+
+    it "prevents XSS" do
+      preview = described_class.new(preview_url)
+      preview.expects(:engine_html).returns(img_html)
+
+      result = preview.to_s
+      expect(result).not_to match(/onerror/)
+    end
+
+  end
+
 end

data/spec/spec_helper.rb

@@ -26,10 +26,6 @@ shared_context "engines" do
   let(:html) { @html }
   let(:data) { @data }
   let(:link) { @link }
-
-  def escaped_data(key)
-    CGI.escapeHTML(data[key])
-  end
 end
 
 shared_examples_for "an engine" do
@@ -64,7 +60,7 @@ shared_examples_for "a layout engine" do
     end
 
     it "includes title" do
-      expect(html).to include(escaped_data(:title))
+      expect(html).to include(data[:title])
     end
 
     it "includes link" do
@@ -76,7 +72,7 @@ shared_examples_for "a layout engine" do
     end
 
     it "includes domain" do
-      expect(html).to include(%|class="domain" href="#{escaped_data(:domain)}|)
+      expect(html).to include(%|class="domain" href="#{data[:domain]}|)
     end
   end
 end

data/templates/_layout.mustache

@@ -1,6 +1,6 @@
 <aside class="onebox {{subname}}">
   <header class="source">
-    <a href="{{{link}}}" target='_blank'>{{domain}}</a>
+    <a href="{{link}}" target='_blank'>{{domain}}</a>
   </header>
   <article class="onebox-body">
     {{{view}}}

data/templates/douban.mustache

@@ -1,5 +1,5 @@
 <img src="{{image}}" class="thumbnail"/>
 
-<h3><a href='{{{link}}}' target='_blank'>{{title}}</a></h3>
+<h3><a href='{{link}}' target='_blank'>{{title}}</a></h3>
 
 <p>{{description}}</p>

data/templates/googledocs.mustache

@@ -1,5 +1,5 @@
-<a href='{{{link}}}' target="_blank"><span class='googledocs-onebox-logo g-{{type}}-logo'></span></a>
+<a href='{{link}}' target="_blank"><span class='googledocs-onebox-logo g-{{type}}-logo'></span></a>
 
-<h3><a href='{{{link}}}' target="_blank">{{title}}</a></h3>
+<h3><a href='{{link}}' target="_blank">{{title}}</a></h3>
 
 <p>{{description}}</p>

data/templates/whitelistedgeneric.mustache

@@ -1,5 +1,5 @@
 {{#image}}<img src="{{image}}" width="{{image_width}}" height="{{image_height}}" class="thumbnail"/>{{/image}}
 
-<h3><a href='{{{link}}}' target="_blank">{{title}}</a></h3>
+<h3><a href='{{link}}' target="_blank">{{title}}</a></h3>
 
 <p>{{description}}</p>

data/templates/wikipedia.mustache

@@ -1,5 +1,5 @@
 {{#image}}<img src="{{image}}" class="thumbnail"/>{{/image}}
 
-<h3><a href='{{{link}}}' target='_blank'>{{title}}</a></h3>
+<h3><a href='{{link}}' target='_blank'>{{title}}</a></h3>
 
 <p>{{description}}</p>

data/templates/xkcd.mustache

@@ -1,4 +1,4 @@
-<h3><a href='{{{link}}}' target='_blank'>{{title}}</a></h3>
+<h3><a href='{{link}}' target='_blank'>{{title}}</a></h3>
 
 <img src="{{image}}" />
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: onebox
 version: !ruby/object:Gem::Version
-  version: 1.7.3
+  version: 1.7.4
 platform: ruby
 authors:
 - Joanna Zeta
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-01-11 00:00:00.000000000 Z
+date: 2017-01-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: multi_json
@@ -96,6 +96,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 1.0.0
+- !ruby/object:Gem::Dependency
+  name: sanitize
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
@@ -361,6 +375,7 @@ files:
 - lib/onebox/layout.rb
 - lib/onebox/layout_support.rb
 - lib/onebox/matcher.rb
+- lib/onebox/onebox_sanitize_config.rb
 - lib/onebox/preview.rb
 - lib/onebox/status_check.rb
 - lib/onebox/template_support.rb