@ecency/render-helper 2.5.11 → 2.5.13

package/dist/node/index.cjs

@@ -205,6 +205,96 @@ var ALLOWED_ATTRIBUTES = {
   "del": [],
   "ins": []
 };
+
+// src/consts/embed-hosts.const.ts
+var ALLOWED_EMBED_HOSTS = /* @__PURE__ */ new Set([
+  // YouTube
+  "www.youtube.com",
+  "youtube.com",
+  "www.youtube-nocookie.com",
+  "youtube-nocookie.com",
+  // Vimeo
+  "player.vimeo.com",
+  // Twitch
+  "player.twitch.tv",
+  // DTube
+  "emb.d.tube",
+  // 3Speak (video + audio)
+  "play.3speak.tv",
+  "3speak.tv",
+  "audio.3speak.tv",
+  // Loom
+  "www.loom.com",
+  // Spotify
+  "open.spotify.com",
+  // SoundCloud
+  "w.soundcloud.com",
+  // BitChute
+  "www.bitchute.com",
+  "bitchute.com",
+  // Rumble
+  "www.rumble.com",
+  "rumble.com",
+  // Brighteon
+  "www.brighteon.com",
+  "brighteon.com",
+  // VIMM
+  "www.vimm.tv",
+  // BrandNewTube
+  "brandnewtube.com",
+  // LBRY / Odysee
+  "lbry.tv",
+  "odysee.com",
+  // Skatehive / Skatehype
+  "ipfs.skatehive.app",
+  "www.skatehype.com",
+  "skatehype.com",
+  // archive.org
+  "archive.org",
+  // Truvvl
+  "embed.truvvl.com",
+  // Aureal
+  "aureal-embed.web.app",
+  "www.aureal-embed.web.app"
+  // Dapplr (player.*.dapplr.in / *.dapplr.in) — host suffix, handled below
+]);
+var ALLOWED_EMBED_HOST_SUFFIXES = [".dapplr.in"];
+var EMBED_HOST_PATH_PATTERNS = {
+  "www.youtube.com": /^\/embed\//,
+  "youtube.com": /^\/embed\//,
+  "www.youtube-nocookie.com": /^\/embed\//,
+  "youtube-nocookie.com": /^\/embed\//,
+  "player.vimeo.com": /^\/video\//,
+  "player.twitch.tv": /^\/$/,
+  // channel/video carried in the query string
+  "emb.d.tube": /^\/$/,
+  // dtube carries the ref in the #! fragment
+  "play.3speak.tv": /^\/(watch|embed)/,
+  "open.spotify.com": /^\/embed\//,
+  "www.loom.com": /^\/embed\//,
+  "www.bitchute.com": /^\/embed\//,
+  "bitchute.com": /^\/embed\//,
+  "www.rumble.com": /^\/embed\//,
+  "rumble.com": /^\/embed\//,
+  "www.brighteon.com": /^\/embed\//,
+  "brighteon.com": /^\/embed\//
+};
+function isAllowedEmbedSrc(value) {
+  if (!value) return false;
+  let url;
+  try {
+    url = new URL(value.trim());
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "https:") return false;
+  const host = url.hostname.toLowerCase();
+  const hostAllowed = ALLOWED_EMBED_HOSTS.has(host) || ALLOWED_EMBED_HOST_SUFFIXES.some((suffix) => host.endsWith(suffix));
+  if (!hostAllowed) return false;
+  const pathPattern = EMBED_HOST_PATH_PATTERNS[host];
+  if (pathPattern && !pathPattern.test(url.pathname)) return false;
+  return true;
+}
 function createParser() {
   return new xmldom.DOMParser({
     onError(level, msg) {
@@ -600,6 +690,14 @@ function buildPictureSources(rawUrl) {
 }
 
 // src/methods/sanitize-html.method.ts
+var EMBED_SRC_DATA_ATTRS = /* @__PURE__ */ new Set(["data-embed-src", "data-video-href"]);
+var isSafeNavValue = (value) => {
+  const trimmed = value.trim().replace(/[\t\n\r\f\v\0]/g, "").toLowerCase();
+  if (!trimmed) return false;
+  const isSafeScheme = /^(https?|mailto|hive|tel|web\+[a-z0-9.+-]+):/i.test(trimmed);
+  const isRelative = /^(\/\/|\/[^/]?|#|\?|[a-z0-9._\-]+(\/|$))/i.test(trimmed);
+  return isSafeScheme || isRelative;
+};
 var decodeEntities = (input) => input.replace(/&#(\d+);?/g, (_, dec) => String.fromCodePoint(Number(dec))).replace(/&#x([0-9a-f]+);?/gi, (_, hex) => String.fromCodePoint(parseInt(hex, 16)));
 var isProxyPSrcset = (srcset) => {
   const base = trimTrailingSlash(getProxyBase());
@@ -627,6 +725,8 @@ function sanitizeHtml(html) {
       if (tag === "video" && ["src", "poster"].includes(name) && !/^https?:\/\//.test(decodedLower)) return "";
       if (tag === "img" && ["dynsrc", "lowsrc"].includes(name)) return "";
       if (tag === "span" && name === "class" && decoded.toLowerCase().trim() === "wr") return "";
+      if (EMBED_SRC_DATA_ATTRS.has(name) && !isAllowedEmbedSrc(decoded)) return "";
+      if (name === "data-href" && !isSafeNavValue(decoded)) return "";
       if (name === "id") {
         if (!ID_WHITELIST.test(decoded)) return "";
       }
@@ -1142,14 +1242,15 @@ function a(el, forApp, parentDomain = "ecency.com", seoContext, renderOptions) {
       el.setAttribute("data-start-time", startTime);
     }
     if (renderOptions?.embedVideosDirectly) {
+      const directSrc = `https://www.youtube.com/embed/${vid}`;
       const wrapper = el.ownerDocument.createElement("span");
       wrapper.setAttribute("class", "er-youtube-frame");
       wrapper.setAttribute("style", "display:block");
       const iframe2 = el.ownerDocument.createElement("iframe");
       iframe2.setAttribute("class", "youtube-player");
-      iframe2.setAttribute("src", embedSrc);
+      iframe2.setAttribute("src", directSrc);
       iframe2.setAttribute("title", "YouTube video");
-      iframe2.setAttribute("allow", "accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture; web-share");
+      iframe2.setAttribute("allow", "accelerometer; encrypted-media; gyroscope; picture-in-picture; web-share");
       iframe2.setAttribute("allowfullscreen", "");
       wrapper.appendChild(iframe2);
       el.appendChild(wrapper);
@@ -1286,12 +1387,13 @@ function a(el, forApp, parentDomain = "ecency.com", seoContext, renderOptions) {
           el.textContent = "";
         }
         if (renderOptions?.embedVideosDirectly) {
+          const directSrc = `${videoHref}&autoplay=false`;
           const wrapper = el.ownerDocument.createElement("span");
           wrapper.setAttribute("class", "er-speak-frame");
           wrapper.setAttribute("style", "display:block");
           const iframe2 = el.ownerDocument.createElement("iframe");
           iframe2.setAttribute("class", "speak-iframe");
-          iframe2.setAttribute("src", videoHref);
+          iframe2.setAttribute("src", directSrc);
           iframe2.setAttribute("title", "3Speak video");
           iframe2.setAttribute("allow", "accelerometer; encrypted-media; gyroscope; picture-in-picture; web-share");
           iframe2.setAttribute("allowfullscreen", "");
@@ -1404,7 +1506,7 @@ function a(el, forApp, parentDomain = "ecency.com", seoContext, renderOptions) {
 }
 
 // src/methods/iframe.method.ts
-function iframe(el, parentDomain = "ecency.com", forApp = false) {
+function iframe(el, parentDomain = "ecency.com", forApp = false, renderOptions) {
   if (!el || !el.parentNode) {
     return;
   }
@@ -1447,7 +1549,12 @@ function iframe(el, parentDomain = "ecency.com", forApp = false) {
       normalizedSrc = `${normalizedSrc}&mode=iframe`;
     }
     const hasAutoplay = /[?&]autoplay=/.test(normalizedSrc);
-    let s = hasAutoplay ? normalizedSrc : `${normalizedSrc}&autoplay=true`;
+    let s;
+    if (renderOptions?.embedVideosDirectly) {
+      s = hasAutoplay ? normalizedSrc.replace(/([?&]autoplay=)[^&]*/i, "$1false") : `${normalizedSrc}&autoplay=false`;
+    } else {
+      s = hasAutoplay ? normalizedSrc : `${normalizedSrc}&autoplay=true`;
+    }
     if (forApp && !/[?&]layout=/.test(s)) {
       s = `${s}&layout=mobile`;
     }
@@ -1761,7 +1868,7 @@ function traverse(node, forApp, depth = 0, state = { firstImageFound: false }, p
       a(child, forApp, parentDomain, seoContext, renderOptions);
     }
     if (child.nodeName.toLowerCase() === "iframe") {
-      iframe(child, parentDomain, forApp);
+      iframe(child, parentDomain, forApp, renderOptions);
     }
     if (child.nodeName === "#text") {
       text(child, forApp);
@@ -2239,6 +2346,7 @@ exports.buildSrcSet = buildSrcSet;
 exports.buildSrcSetForFormat = buildSrcSetForFormat;
 exports.catchPostImage = catchPostImage;
 exports.getEntryImageRawUrl = getEntryImageRawUrl;
+exports.isAllowedEmbedSrc = isAllowedEmbedSrc;
 exports.isPictureEligibleRawUrl = isPictureEligibleRawUrl;
 exports.isValidPermlink = isValidPermlink;
 exports.postBodySummary = getPostBodySummary;