@ecency/render-helper 2.5.11 → 2.5.13

package/dist/browser/index.d.ts

@@ -133,6 +133,20 @@ declare function setCacheSize(size: number): void;
 
 declare const SECTION_LIST: string[];
 
+/**
+ * True iff `value` is an absolute https:// URL whose host is one the renderer
+ * is permitted to embed AND (for hosts with a known embed-path shape) whose
+ * path matches that shape. Used to validate data-embed-src / data-video-href in
+ * the sanitizer and the iframe `src` the client video extensions assign.
+ *
+ * Defensive: never throws (a malformed URL returns false), rejects every
+ * non-https scheme (javascript:, data:, http:, protocol-relative //host),
+ * compares the parsed hostname so an attacker can't smuggle an allowed host as
+ * a path/query/userinfo/subdomain-suffix segment, and constrains the path so an
+ * allowed host can't be aimed at a non-embed route.
+ */
+declare function isAllowedEmbedSrc(value?: string | null): boolean;
+
 declare function isValidPermlink(permlink: string): boolean;
 
 /**
@@ -145,4 +159,4 @@ declare function isValidPermlink(permlink: string): boolean;
  */
 declare function simpleMarkdownToHTML(input: string): string;
 
-export { type Entry, IMAGE_SIZES, type ProxifyOptions, type RenderOptions, SECTION_LIST, type SeoContext, buildPictureSources, buildSrcSet, buildSrcSetForFormat, catchPostImage, getEntryImageRawUrl, isPictureEligibleRawUrl, isValidPermlink, getPostBodySummary as postBodySummary, proxifyImageSrc, markdown2Html as renderPostBody, setCacheSize, setProxyBase, setSlowRenderThresholdMs, simpleMarkdownToHTML };
+export { type Entry, IMAGE_SIZES, type ProxifyOptions, type RenderOptions, SECTION_LIST, type SeoContext, buildPictureSources, buildSrcSet, buildSrcSetForFormat, catchPostImage, getEntryImageRawUrl, isAllowedEmbedSrc, isPictureEligibleRawUrl, isValidPermlink, getPostBodySummary as postBodySummary, proxifyImageSrc, markdown2Html as renderPostBody, setCacheSize, setProxyBase, setSlowRenderThresholdMs, simpleMarkdownToHTML };

package/dist/browser/index.js

@@ -176,6 +176,96 @@ var ALLOWED_ATTRIBUTES = {
   "del": [],
   "ins": []
 };
+
+// src/consts/embed-hosts.const.ts
+var ALLOWED_EMBED_HOSTS = /* @__PURE__ */ new Set([
+  // YouTube
+  "www.youtube.com",
+  "youtube.com",
+  "www.youtube-nocookie.com",
+  "youtube-nocookie.com",
+  // Vimeo
+  "player.vimeo.com",
+  // Twitch
+  "player.twitch.tv",
+  // DTube
+  "emb.d.tube",
+  // 3Speak (video + audio)
+  "play.3speak.tv",
+  "3speak.tv",
+  "audio.3speak.tv",
+  // Loom
+  "www.loom.com",
+  // Spotify
+  "open.spotify.com",
+  // SoundCloud
+  "w.soundcloud.com",
+  // BitChute
+  "www.bitchute.com",
+  "bitchute.com",
+  // Rumble
+  "www.rumble.com",
+  "rumble.com",
+  // Brighteon
+  "www.brighteon.com",
+  "brighteon.com",
+  // VIMM
+  "www.vimm.tv",
+  // BrandNewTube
+  "brandnewtube.com",
+  // LBRY / Odysee
+  "lbry.tv",
+  "odysee.com",
+  // Skatehive / Skatehype
+  "ipfs.skatehive.app",
+  "www.skatehype.com",
+  "skatehype.com",
+  // archive.org
+  "archive.org",
+  // Truvvl
+  "embed.truvvl.com",
+  // Aureal
+  "aureal-embed.web.app",
+  "www.aureal-embed.web.app"
+  // Dapplr (player.*.dapplr.in / *.dapplr.in) — host suffix, handled below
+]);
+var ALLOWED_EMBED_HOST_SUFFIXES = [".dapplr.in"];
+var EMBED_HOST_PATH_PATTERNS = {
+  "www.youtube.com": /^\/embed\//,
+  "youtube.com": /^\/embed\//,
+  "www.youtube-nocookie.com": /^\/embed\//,
+  "youtube-nocookie.com": /^\/embed\//,
+  "player.vimeo.com": /^\/video\//,
+  "player.twitch.tv": /^\/$/,
+  // channel/video carried in the query string
+  "emb.d.tube": /^\/$/,
+  // dtube carries the ref in the #! fragment
+  "play.3speak.tv": /^\/(watch|embed)/,
+  "open.spotify.com": /^\/embed\//,
+  "www.loom.com": /^\/embed\//,
+  "www.bitchute.com": /^\/embed\//,
+  "bitchute.com": /^\/embed\//,
+  "www.rumble.com": /^\/embed\//,
+  "rumble.com": /^\/embed\//,
+  "www.brighteon.com": /^\/embed\//,
+  "brighteon.com": /^\/embed\//
+};
+function isAllowedEmbedSrc(value) {
+  if (!value) return false;
+  let url;
+  try {
+    url = new URL(value.trim());
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "https:") return false;
+  const host = url.hostname.toLowerCase();
+  const hostAllowed = ALLOWED_EMBED_HOSTS.has(host) || ALLOWED_EMBED_HOST_SUFFIXES.some((suffix) => host.endsWith(suffix));
+  if (!hostAllowed) return false;
+  const pathPattern = EMBED_HOST_PATH_PATTERNS[host];
+  if (pathPattern && !pathPattern.test(url.pathname)) return false;
+  return true;
+}
 function createParser() {
   return new DOMParser$1({
     onError(level, msg) {
@@ -571,6 +661,14 @@ function buildPictureSources(rawUrl) {
 }
 
 // src/methods/sanitize-html.method.ts
+var EMBED_SRC_DATA_ATTRS = /* @__PURE__ */ new Set(["data-embed-src", "data-video-href"]);
+var isSafeNavValue = (value) => {
+  const trimmed = value.trim().replace(/[\t\n\r\f\v\0]/g, "").toLowerCase();
+  if (!trimmed) return false;
+  const isSafeScheme = /^(https?|mailto|hive|tel|web\+[a-z0-9.+-]+):/i.test(trimmed);
+  const isRelative = /^(\/\/|\/[^/]?|#|\?|[a-z0-9._\-]+(\/|$))/i.test(trimmed);
+  return isSafeScheme || isRelative;
+};
 var decodeEntities = (input) => input.replace(/&#(\d+);?/g, (_, dec) => String.fromCodePoint(Number(dec))).replace(/&#x([0-9a-f]+);?/gi, (_, hex) => String.fromCodePoint(parseInt(hex, 16)));
 var isProxyPSrcset = (srcset) => {
   const base = trimTrailingSlash(getProxyBase());
@@ -598,6 +696,8 @@ function sanitizeHtml(html) {
       if (tag === "video" && ["src", "poster"].includes(name) && !/^https?:\/\//.test(decodedLower)) return "";
       if (tag === "img" && ["dynsrc", "lowsrc"].includes(name)) return "";
       if (tag === "span" && name === "class" && decoded.toLowerCase().trim() === "wr") return "";
+      if (EMBED_SRC_DATA_ATTRS.has(name) && !isAllowedEmbedSrc(decoded)) return "";
+      if (name === "data-href" && !isSafeNavValue(decoded)) return "";
       if (name === "id") {
         if (!ID_WHITELIST.test(decoded)) return "";
       }
@@ -1113,14 +1213,15 @@ function a(el, forApp, parentDomain = "ecency.com", seoContext, renderOptions) {
       el.setAttribute("data-start-time", startTime);
     }
     if (renderOptions?.embedVideosDirectly) {
+      const directSrc = `https://www.youtube.com/embed/${vid}`;
       const wrapper = el.ownerDocument.createElement("span");
       wrapper.setAttribute("class", "er-youtube-frame");
       wrapper.setAttribute("style", "display:block");
       const iframe2 = el.ownerDocument.createElement("iframe");
       iframe2.setAttribute("class", "youtube-player");
-      iframe2.setAttribute("src", embedSrc);
+      iframe2.setAttribute("src", directSrc);
       iframe2.setAttribute("title", "YouTube video");
-      iframe2.setAttribute("allow", "accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture; web-share");
+      iframe2.setAttribute("allow", "accelerometer; encrypted-media; gyroscope; picture-in-picture; web-share");
       iframe2.setAttribute("allowfullscreen", "");
       wrapper.appendChild(iframe2);
       el.appendChild(wrapper);
@@ -1257,12 +1358,13 @@ function a(el, forApp, parentDomain = "ecency.com", seoContext, renderOptions) {
           el.textContent = "";
         }
         if (renderOptions?.embedVideosDirectly) {
+          const directSrc = `${videoHref}&autoplay=false`;
           const wrapper = el.ownerDocument.createElement("span");
           wrapper.setAttribute("class", "er-speak-frame");
           wrapper.setAttribute("style", "display:block");
           const iframe2 = el.ownerDocument.createElement("iframe");
           iframe2.setAttribute("class", "speak-iframe");
-          iframe2.setAttribute("src", videoHref);
+          iframe2.setAttribute("src", directSrc);
           iframe2.setAttribute("title", "3Speak video");
           iframe2.setAttribute("allow", "accelerometer; encrypted-media; gyroscope; picture-in-picture; web-share");
           iframe2.setAttribute("allowfullscreen", "");
@@ -1375,7 +1477,7 @@ function a(el, forApp, parentDomain = "ecency.com", seoContext, renderOptions) {
 }
 
 // src/methods/iframe.method.ts
-function iframe(el, parentDomain = "ecency.com", forApp = false) {
+function iframe(el, parentDomain = "ecency.com", forApp = false, renderOptions) {
   if (!el || !el.parentNode) {
     return;
   }
@@ -1418,7 +1520,12 @@ function iframe(el, parentDomain = "ecency.com", forApp = false) {
       normalizedSrc = `${normalizedSrc}&mode=iframe`;
     }
     const hasAutoplay = /[?&]autoplay=/.test(normalizedSrc);
-    let s = hasAutoplay ? normalizedSrc : `${normalizedSrc}&autoplay=true`;
+    let s;
+    if (renderOptions?.embedVideosDirectly) {
+      s = hasAutoplay ? normalizedSrc.replace(/([?&]autoplay=)[^&]*/i, "$1false") : `${normalizedSrc}&autoplay=false`;
+    } else {
+      s = hasAutoplay ? normalizedSrc : `${normalizedSrc}&autoplay=true`;
+    }
     if (forApp && !/[?&]layout=/.test(s)) {
       s = `${s}&layout=mobile`;
     }
@@ -1732,7 +1839,7 @@ function traverse(node, forApp, depth = 0, state = { firstImageFound: false }, p
       a(child, forApp, parentDomain, seoContext, renderOptions);
     }
     if (child.nodeName.toLowerCase() === "iframe") {
-      iframe(child, parentDomain, forApp);
+      iframe(child, parentDomain, forApp, renderOptions);
     }
     if (child.nodeName === "#text") {
       text(child, forApp);
@@ -2203,6 +2310,6 @@ function getPostBodySummary(obj, length, platform) {
   return res;
 }
 
-export { IMAGE_SIZES, SECTION_LIST, buildPictureSources, buildSrcSet, buildSrcSetForFormat, catchPostImage, getEntryImageRawUrl, isPictureEligibleRawUrl, isValidPermlink, getPostBodySummary as postBodySummary, proxifyImageSrc, markdown2Html as renderPostBody, setCacheSize, setProxyBase, setSlowRenderThresholdMs, simpleMarkdownToHTML };
+export { IMAGE_SIZES, SECTION_LIST, buildPictureSources, buildSrcSet, buildSrcSetForFormat, catchPostImage, getEntryImageRawUrl, isAllowedEmbedSrc, isPictureEligibleRawUrl, isValidPermlink, getPostBodySummary as postBodySummary, proxifyImageSrc, markdown2Html as renderPostBody, setCacheSize, setProxyBase, setSlowRenderThresholdMs, simpleMarkdownToHTML };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map