domma-cms 0.34.1 → 0.36.0

package/server/services/email.js

@@ -1,167 +1,167 @@
-/**
- * Core Email Utility
- * Nodemailer transport factory and generic form email sending utility.
- */
-import nodemailer from 'nodemailer';
-
-let lastSendResult = null;
-
-/**
- * Return the most recent email send result, or null if no send has occurred.
- *
- * @returns {{ ok: boolean, at: string, info: string|null } | null}
- */
-export function getLastSendResult() {
-    return lastSendResult;
-}
-
-/**
- * Record the outcome of an email send for health reporting.
- *
- * @param {boolean} ok
- * @param {string|null} info
- * @returns {void}
- */
-function recordSendResult(ok, info) {
-    lastSendResult = {
-        ok,
-        at: new Date().toISOString(),
-        info: info || null
-    };
-}
-
-/**
- * Escape HTML special characters for safe use in email bodies.
- *
- * @param {string} str
- * @returns {string}
- */
-export function escapeHtml(str) {
-    return String(str)
-        .replace(/&/g, '&')
-        .replace(/</g, '&lt;')
-        .replace(/>/g, '&gt;')
-        .replace(/"/g, '&quot;')
-        .replace(/'/g, '&#39;');
-}
-
-/**
- * Create a nodemailer transport.
- * Falls back to an Ethereal test account when no SMTP host is configured.
- *
- * @param {{ host: string, port: number, secure: boolean, user: string, pass: string }} smtp
- * @returns {Promise<import('nodemailer').Transporter>}
- * @throws {Error} If Ethereal test account creation fails.
- */
-export async function createTransport(smtp) {
-    if (smtp?.host) {
-        return nodemailer.createTransport({
-            host: smtp.host,
-            port: smtp.port || 587,
-            secure: smtp.secure || false,
-            auth: smtp.user ? { user: smtp.user, pass: smtp.pass } : undefined,
-            tls: { rejectUnauthorized: false }
-        });
-    }
-
-    // No SMTP configured — use Ethereal for dev/demo
-    const testAccount = await nodemailer.createTestAccount();
-    console.log('[email] No SMTP configured. Using Ethereal test account:', testAccount.user);
-    return nodemailer.createTransport({
-        host: 'smtp.ethereal.email',
-        port: 587,
-        secure: false,
-        auth: { user: testAccount.user, pass: testAccount.pass }
-    });
-}
-
-/**
- * Send a generic transactional email.
- *
- * @param {import('nodemailer').Transporter} transport
- * @param {{ from: string, fromName: string, to: string, subject: string, html: string, text: string }} opts
- * @returns {Promise<void>}
- * @throws {Error} If sending the email fails.
- */
-export async function sendEmail(transport, {from, fromName, to, subject, html, text}) {
-    try {
-        const info = await transport.sendMail({
-            from: `"${fromName}" <${from}>`,
-            to,
-            subject,
-            text,
-            html
-        });
-        recordSendResult(true, info.messageId);
-
-        const previewUrl = nodemailer.getTestMessageUrl(info);
-        if (previewUrl) {
-            console.log('[email] Preview URL:', previewUrl);
-        }
-        return info;
-    } catch (err) {
-        recordSendResult(false, err.message);
-        throw err;
-    }
-}
-
-/**
- * Send an HTML + plain-text form submission notification email.
- * Builds a generic table of field→value pairs from the submitted data.
- *
- * @param {import('nodemailer').Transporter} transport
- * @param {{ from: string, fromName: string, to: string, subject: string, formTitle: string, fields: Array<{name: string, label: string}>, data: Record<string, unknown> }} opts
- * @returns {Promise<void>}
- * @throws {Error} If sending the email fails.
- */
-export async function sendFormEmail(transport, { from, fromName, to, subject, formTitle, fields, data }) {
-    const rows = fields.map(field => {
-        const val  = data[field.name] ?? '';
-        const safe = escapeHtml(String(val)).replace(/\n/g, '<br>');
-        const safeLabel = escapeHtml(field.label || field.name);
-        return `
-        <tr>
-            <td style="padding:8px 12px;font-weight:600;background:#f9f9f9;border:1px solid #eee;white-space:nowrap;vertical-align:top;">${safeLabel}</td>
-            <td style="padding:8px 12px;border:1px solid #eee;vertical-align:top;">${safe}</td>
-        </tr>`.trim();
-    }).join('\n');
-
-    const plainRows = fields.map(field => {
-        const val = data[field.name] ?? '';
-        return `${field.label || field.name}: ${val}`;
-    }).join('\n');
-
-    const html = `
-<!DOCTYPE html>
-<html>
-<body style="font-family:sans-serif;max-width:640px;margin:0 auto;padding:20px;">
-    <h2 style="color:#333;margin-bottom:4px;">New Form Submission</h2>
-    <p style="color:#888;margin-top:0;font-size:.9rem;">${escapeHtml(formTitle)}</p>
-    <table style="width:100%;border-collapse:collapse;margin-top:16px;">
-        ${rows}
-    </table>
-</body>
-</html>`.trim();
-
-    const text = `New form submission: ${formTitle}\n\n${plainRows}`;
-
-    try {
-        const info = await transport.sendMail({
-            from: `"${fromName}" <${from}>`,
-            to,
-            subject,
-            text,
-            html
-        });
-        recordSendResult(true, info.messageId);
-
-        const previewUrl = nodemailer.getTestMessageUrl(info);
-        if (previewUrl) {
-            console.log('[email] Preview URL:', previewUrl);
-        }
-        return info;
-    } catch (err) {
-        recordSendResult(false, err.message);
-        throw err;
-    }
-}
+/**
+ * Core Email Utility
+ * Nodemailer transport factory and generic form email sending utility.
+ */
+import nodemailer from 'nodemailer';
+
+let lastSendResult = null;
+
+/**
+ * Return the most recent email send result, or null if no send has occurred.
+ *
+ * @returns {{ ok: boolean, at: string, info: string|null } | null}
+ */
+export function getLastSendResult() {
+    return lastSendResult;
+}
+
+/**
+ * Record the outcome of an email send for health reporting.
+ *
+ * @param {boolean} ok
+ * @param {string|null} info
+ * @returns {void}
+ */
+function recordSendResult(ok, info) {
+    lastSendResult = {
+        ok,
+        at: new Date().toISOString(),
+        info: info || null
+    };
+}
+
+/**
+ * Escape HTML special characters for safe use in email bodies.
+ *
+ * @param {string} str
+ * @returns {string}
+ */
+export function escapeHtml(str) {
+    return String(str)
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+
+/**
+ * Create a nodemailer transport.
+ * Falls back to an Ethereal test account when no SMTP host is configured.
+ *
+ * @param {{ host: string, port: number, secure: boolean, user: string, pass: string }} smtp
+ * @returns {Promise<import('nodemailer').Transporter>}
+ * @throws {Error} If Ethereal test account creation fails.
+ */
+export async function createTransport(smtp) {
+    if (smtp?.host) {
+        return nodemailer.createTransport({
+            host: smtp.host,
+            port: smtp.port || 587,
+            secure: smtp.secure || false,
+            auth: smtp.user ? { user: smtp.user, pass: smtp.pass } : undefined,
+            tls: { rejectUnauthorized: false }
+        });
+    }
+
+    // No SMTP configured — use Ethereal for dev/demo
+    const testAccount = await nodemailer.createTestAccount();
+    console.log('[email] No SMTP configured. Using Ethereal test account:', testAccount.user);
+    return nodemailer.createTransport({
+        host: 'smtp.ethereal.email',
+        port: 587,
+        secure: false,
+        auth: { user: testAccount.user, pass: testAccount.pass }
+    });
+}
+
+/**
+ * Send a generic transactional email.
+ *
+ * @param {import('nodemailer').Transporter} transport
+ * @param {{ from: string, fromName: string, to: string, subject: string, html: string, text: string }} opts
+ * @returns {Promise<void>}
+ * @throws {Error} If sending the email fails.
+ */
+export async function sendEmail(transport, {from, fromName, to, subject, html, text}) {
+    try {
+        const info = await transport.sendMail({
+            from: `"${fromName}" <${from}>`,
+            to,
+            subject,
+            text,
+            html
+        });
+        recordSendResult(true, info.messageId);
+
+        const previewUrl = nodemailer.getTestMessageUrl(info);
+        if (previewUrl) {
+            console.log('[email] Preview URL:', previewUrl);
+        }
+        return info;
+    } catch (err) {
+        recordSendResult(false, err.message);
+        throw err;
+    }
+}
+
+/**
+ * Send an HTML + plain-text form submission notification email.
+ * Builds a generic table of field→value pairs from the submitted data.
+ *
+ * @param {import('nodemailer').Transporter} transport
+ * @param {{ from: string, fromName: string, to: string, subject: string, formTitle: string, fields: Array<{name: string, label: string}>, data: Record<string, unknown> }} opts
+ * @returns {Promise<void>}
+ * @throws {Error} If sending the email fails.
+ */
+export async function sendFormEmail(transport, { from, fromName, to, subject, formTitle, fields, data }) {
+    const rows = fields.map(field => {
+        const val  = data[field.name] ?? '';
+        const safe = escapeHtml(String(val)).replace(/\n/g, '<br>');
+        const safeLabel = escapeHtml(field.label || field.name);
+        return `
+        <tr>
+            <td style="padding:8px 12px;font-weight:600;background:#f9f9f9;border:1px solid #eee;white-space:nowrap;vertical-align:top;">${safeLabel}</td>
+            <td style="padding:8px 12px;border:1px solid #eee;vertical-align:top;">${safe}</td>
+        </tr>`.trim();
+    }).join('\n');
+
+    const plainRows = fields.map(field => {
+        const val = data[field.name] ?? '';
+        return `${field.label || field.name}: ${val}`;
+    }).join('\n');
+
+    const html = `
+<!DOCTYPE html>
+<html>
+<body style="font-family:sans-serif;max-width:640px;margin:0 auto;padding:20px;">
+    <h2 style="color:#333;margin-bottom:4px;">New Form Submission</h2>
+    <p style="color:#888;margin-top:0;font-size:.9rem;">${escapeHtml(formTitle)}</p>
+    <table style="width:100%;border-collapse:collapse;margin-top:16px;">
+        ${rows}
+    </table>
+</body>
+</html>`.trim();
+
+    const text = `New form submission: ${formTitle}\n\n${plainRows}`;
+
+    try {
+        const info = await transport.sendMail({
+            from: `"${fromName}" <${from}>`,
+            to,
+            subject,
+            text,
+            html
+        });
+        recordSendResult(true, info.messageId);
+
+        const previewUrl = nodemailer.getTestMessageUrl(info);
+        if (previewUrl) {
+            console.log('[email] Preview URL:', previewUrl);
+        }
+        return info;
+    } catch (err) {
+        recordSendResult(false, err.message);
+        throw err;
+    }
+}

package/server/services/markdown.js

@@ -24,7 +24,7 @@ const BUILTIN_SHORTCODES = new Set([
     'text', 'button', 'link', 'cta', 'grid', 'row', 'col', 'card',
     'banner', 'slideover', 'counter', 'celebrate', 'firework', 'fireworks', 'scribe',
     'reveal', 'breathe', 'pulse', 'shake', 'scramble', 'ripple', 'twinkle',
-    'ticker-tape', 'animate', 'ambient', 'list-group', 'menu',
+    'ticker-tape', 'butterflies', 'strobe', 'animate', 'ambient', 'list-group', 'menu',
 ]);
 
 // Configure marked for safe output
@@ -1265,7 +1265,7 @@ async function processPluginShortcodes(markdown) {
  * Process built-in Effects shortcodes natively.
  * Handles: [counter /], [celebrate /], [firework], [fireworks], [scribe],
  *          [reveal], [breathe], [pulse], [shake], [scramble], [ripple],
- *          [twinkle], [ticker-tape], [animate], [ambient]
+ *          [twinkle], [ticker-tape], [butterflies], [strobe], [animate], [ambient]
  *
  * @param {string} markdown
  * @returns {string}
@@ -1399,6 +1399,25 @@ function processEffectsBlocks(markdown) {
         return `<div class="dm-fx-ticker-tape" data-fx-mode="container"${dataAttrs}>${innerHtml}</div>\n`;
     });
 
+    // [butterflies /]            → full-page overlay (mode=page)
+    // [butterflies] body [/butterflies] → container-scoped (mode=container)
+    // [strobe /] / [strobe] body [/strobe] — same shape
+    for (const name of ['butterflies', 'strobe']) {
+        apply(name, (attrStr, body) => {
+            const attrs = parseShortcodeAttrs(attrStr);
+            const dataAttrs = Object.entries(attrs)
+                .map(([k, v]) => ` data-fx-${k}="${escapeAttr(String(v))}"`)
+                .join('');
+            if (body === null) {
+                return `<div class="dm-fx-${name}" data-fx-mode="page"${dataAttrs}></div>`;
+            }
+            // Restore code placeholders before the nested parse (tabs-handler
+            // pattern) so code spans/fences render as <code>, not raw backticks.
+            const innerHtml = marked.parse(processCardBlocks(processGridBlocks(restore(body.trim()))));
+            return `<div class="dm-fx-${name}" data-fx-mode="container"${dataAttrs}>${innerHtml}</div>\n`;
+        });
+    }
+
     apply('animate', (attrStr, body) => {
         if (body === null) return '';
         const attrs = parseShortcodeAttrs(attrStr);
@@ -3065,6 +3084,177 @@ function processIconBlocks(markdown) {
   ));
 }
 
+// ─── [embed] — video / iframe embeds ───────────────────────────────────────
+
+/**
+ * Classify an embed URL into one of: youtube, vimeo, video (self-hosted),
+ * iframe (generic) or invalid. Pure — no allow-list logic here; the host
+ * allow-list is applied at render time for the generic-iframe case only.
+ *
+ * @param {string} url
+ * @returns {{type:('youtube'|'vimeo'|'video'|'iframe'|'invalid'), src?:string, id?:string, host?:string, mime?:string}}
+ */
+export function classifyEmbedUrl(url) {
+  const u = String(url ?? '').trim();
+  if (!u) return {type: 'invalid'};
+
+  let m;
+  // YouTube — watch?v=, youtu.be/, /embed/, /shorts/, /live/. Any non-empty
+  // id token counts so a YouTube host never falls through to the generic
+  // iframe path (which would show a misleading "not allow-listed" message).
+  if ((m = u.match(/(?:youtube(?:-nocookie)?\.com\/(?:watch\?(?:[^#]*&)?v=|embed\/|shorts\/|live\/)|youtu\.be\/)([\w-]+)/i))) {
+    return {type: 'youtube', id: m[1], src: `https://www.youtube-nocookie.com/embed/${m[1]}`};
+  }
+  // Vimeo — vimeo.com/ID or player.vimeo.com/video/ID
+  if ((m = u.match(/vimeo\.com\/(?:video\/)?(\d+)/i))) {
+    return {type: 'vimeo', id: m[1], src: `https://player.vimeo.com/video/${m[1]}`};
+  }
+  // Self-hosted video — by file extension (optional query/hash suffix)
+  if ((m = u.match(/\.(mp4|webm|ogg|ogv)(?:\?[^#]*)?(?:#.*)?$/i))) {
+    const ext = m[1].toLowerCase();
+    const mime = ext === 'mp4' ? 'video/mp4' : ext === 'webm' ? 'video/webm' : 'video/ogg';
+    return {type: 'video', src: u, mime};
+  }
+  // Generic http(s) — host decides allow/deny at render time
+  if (/^https?:\/\//i.test(u)) {
+    try {
+      return {type: 'iframe', src: u, host: new URL(u).hostname};
+    } catch {
+      return {type: 'invalid'};
+    }
+  }
+  return {type: 'invalid'};
+}
+
+const EMBED_RATIOS = {
+  '16:9': '16 / 9', '4:3': '4 / 3', '1:1': '1 / 1',
+  '21:9': '21 / 9', '9:16': '9 / 16', '3:4': '3 / 4',
+};
+
+function _embedRatio(raw) {
+  if (!raw || raw === true) return '16 / 9';
+  const key = String(raw).trim();
+  if (EMBED_RATIOS[key]) return EMBED_RATIOS[key];
+  const m = key.match(/^(\d{1,2}):(\d{1,2})$/);   // bounded arbitrary W:H
+  return m ? `${m[1]} / ${m[2]}` : '16 / 9';
+}
+
+function _embedBlocked(message) {
+  return `<div class="dm-embed-blocked" role="note">⚠ ${message}</div>`;
+}
+
+const _embedFlag = (v) => v === true || v === '' || v === 'true';
+
+/**
+ * Render a single [embed] shortcode into sanitiser-safe HTML. YouTube/Vimeo
+ * and self-hosted video always render; a generic iframe renders only when its
+ * host is in `allowedHosts`, otherwise a visible placeholder is returned.
+ *
+ * @param {object} attrs - Parsed shortcode attributes (`url` required).
+ * @param {string[]} [allowedHosts] - Extra iframe hostnames permitted for the
+ *   generic-iframe case (YouTube/Vimeo hosts are always permitted).
+ * @returns {string}
+ */
+export function renderEmbed(attrs, allowedHosts = []) {
+  const info = classifyEmbedUrl(attrs.url);
+  if (info.type === 'invalid') return _embedBlocked('Invalid embed URL.');
+
+  const ratio = _embedRatio(attrs.ratio);
+  const title = attrs.title ? escapeAttr(attrs.title) : '';
+  const autoplay = _embedFlag(attrs.autoplay);
+  const loop = _embedFlag(attrs.loop);
+  const muted = _embedFlag(attrs.muted);
+
+  // Outer <figure> — width + alignment.
+  const figStyles = ['margin:1.5rem 0'];
+  if (attrs.width) {
+    const w = /^\d+%$/.test(attrs.width) ? attrs.width : `${parseInt(attrs.width, 10) || 0}px`;
+    if (w !== '0px') figStyles.push(`max-width:${w}`);
+  }
+  const align = String(attrs.align || '').toLowerCase();
+  if (align === 'center') figStyles.push('margin-left:auto', 'margin-right:auto');
+  else if (align === 'right') figStyles.push('margin-left:auto');
+
+  let inner;
+  if (info.type === 'video') {
+    const flags = ['controls', 'playsinline'];
+    if (autoplay) flags.push('autoplay', 'muted');   // browsers block un-muted autoplay
+    else if (muted) flags.push('muted');
+    if (loop) flags.push('loop');
+    inner = `<video ${flags.join(' ')} preload="metadata"`
+      + ` style="position:absolute;inset:0;width:100%;height:100%;display:block;background:#000">`
+      + `<source src="${escapeAttr(info.src)}" type="${escapeAttr(info.mime)}"></video>`;
+  } else {
+    if (info.type === 'iframe') {
+      const allowed = allowedHosts.map(h => String(h).toLowerCase());
+      if (!allowed.includes(String(info.host).toLowerCase())) {
+        return _embedBlocked(
+          `Embedded content from <code>${escapeAttr(info.host)}</code> is not in the allow-list (config/embeds.json).`);
+      }
+    }
+    let src = info.src;
+    if (info.type === 'youtube' || info.type === 'vimeo') {
+      const muteKey = info.type === 'youtube' ? 'mute=1' : 'muted=1';
+      const params = [];
+      if (autoplay) params.push('autoplay=1', muteKey);
+      else if (muted) params.push(muteKey);
+      if (loop) info.type === 'youtube' ? params.push('loop=1', `playlist=${info.id}`) : params.push('loop=1');
+      if (params.length) src += (src.includes('?') ? '&' : '?') + params.join('&');
+    }
+    inner = `<iframe src="${escapeAttr(src)}"${title ? ` title="${title}"` : ''}`
+      + ` loading="lazy" referrerpolicy="strict-origin-when-cross-origin"`
+      + ` allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share"`
+      + ` allowfullscreen style="position:absolute;inset:0;width:100%;height:100%;border:0"></iframe>`;
+  }
+
+  const caption = title ? `\n<figcaption class="dm-embed-caption">${title}</figcaption>` : '';
+  return `<figure class="dm-embed" style="${figStyles.join(';')}">`
+    + `<div class="dm-embed-frame" style="position:relative;width:100%;aspect-ratio:${ratio}">${inner}</div>`
+    + `${caption}</figure>`;
+}
+
+/**
+ * Read the generic-iframe host allow-list from config/embeds.json. A missing
+ * file yields no extra hosts — YouTube/Vimeo and self-hosted video still work.
+ *
+ * @returns {string[]}
+ */
+export function getEmbedAllowedHosts() {
+  try {
+    const cfg = getConfig('embeds');
+    return Array.isArray(cfg?.allowedHosts) ? cfg.allowedHosts : [];
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Pre-process [embed] self-closing shortcodes before running through marked.
+ *
+ * Syntax:
+ *   [embed url="https://youtu.be/ID" /]
+ *   [embed url="/media/clip.mp4" ratio="16:9" title="..." autoplay muted loop /]
+ *   [embed url="https://maps.example.com/..." width="640" align="center" /]
+ *
+ * Supported attributes:
+ *   url   - YouTube/Vimeo link, self-hosted video path, or generic iframe URL (required)
+ *   ratio - Aspect ratio: 16:9 (default), 4:3, 1:1, 21:9, 9:16, 3:4, or W:H
+ *   title - Accessibility title + visible caption
+ *   width - Max width (px or %); align - left | center | right
+ *   autoplay / loop / muted - Playback flags (autoplay forces muted)
+ *
+ * @param {string} markdown
+ * @returns {string}
+ */
+function processEmbedBlocks(markdown) {
+  const {scrubbed, restore} = scrubCodeRegions(markdown);
+  const allowedHosts = getEmbedAllowedHosts();
+  return restore(scrubbed.replace(
+    /\[embed([^\]]*?)\/?\]/gi,
+    (_, attrStr) => '\n' + renderEmbed(parseShortcodeAttrs(attrStr || ''), allowedHosts) + '\n'
+  ));
+}
+
 /**
  * Pre-process [form] self-closing shortcodes before running through marked.
  *
@@ -3209,7 +3399,7 @@ function processHeroBlocks(markdown) {
         const heroColor = attrs.color ? String(attrs.color) : '';
         const minHeight = attrs['min-height'] ? String(attrs['min-height']) : '';
 
-      const HERO_INJECTABLE = ['reveal', 'breathe', 'pulse', 'twinkle', 'ticker-tape', 'ambient', 'animate'];
+      const HERO_INJECTABLE = ['reveal', 'breathe', 'pulse', 'twinkle', 'ticker-tape', 'butterflies', 'strobe', 'ambient', 'animate'];
       const injected = extractInjectedEffects(attrs, HERO_INJECTABLE);
 
       // Legacy ad-hoc 'blobs' flag — keep for backward compat. Different keyspace
@@ -3556,7 +3746,8 @@ export async function parseMarkdown(raw, opts = {}) {
     const withSpacer = processSpacerBlocks(withListGroup);
     const withCenter = processCenterBlocks(withSpacer);
     const withIcon = processIconBlocks(withCenter);
-  const withForm = await processFormBlocks(withIcon, tagSet);
+    const withEmbed = processEmbedBlocks(withIcon);
+  const withForm = await processFormBlocks(withEmbed, tagSet);
   const withHero = processHeroBlocks(withForm);
   const withTable = processTableBlocks(withHero);
   const withBadge  = processBadgeBlocks(withTable);
@@ -3575,10 +3766,20 @@ export async function parseMarkdown(raw, opts = {}) {
     // reach the page. Admins write block templates; same trust model as
     // content/custom.css. This flag silences sanitize-html's warning.
     allowVulnerableTags: true,
+    // [embed] emits <iframe>/<video>; hostnames are gated by
+    // allowedIframeHostnames below (defence in depth over the render-time
+    // host allow-list).
+    allowedIframeHostnames: [
+      'www.youtube-nocookie.com', 'www.youtube.com', 'youtube.com',
+      'player.vimeo.com',
+      ...getEmbedAllowedHosts(),
+    ],
     allowedTags: sanitizeHtml.defaults.allowedTags.concat([
       'img', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6',
       'form', 'input', 'textarea', 'select', 'option', 'optgroup',
       'button', 'label', 'fieldset', 'legend',
+      // [embed] shortcode output
+      'iframe', 'video', 'source', 'figure', 'figcaption',
       // <style> tags are emitted by block rendering (buildBlockStyleTag) so
       // per-block custom CSS can reach the page. Admin-trust: block authors
       // are admins, same security model as site-wide content/custom.css.
@@ -3605,6 +3806,11 @@ export async function parseMarkdown(raw, opts = {}) {
         button: ['type', 'disabled', 'aria-label', 'data-action', 'data-entry', 'data-confirm'],
       label: ['for'],
       fieldset: ['disabled'],
+      iframe: ['src', 'title', 'width', 'height', 'allow', 'allowfullscreen',
+        'loading', 'referrerpolicy', 'frameborder', 'style'],
+      video: ['controls', 'autoplay', 'muted', 'loop', 'playsinline',
+        'preload', 'poster', 'width', 'height', 'style'],
+      source: ['src', 'type'],
       // Allow any attribute on every registered dm-* tag. Props are
       // author-defined and enumerating them at sanitise time has no security
       // benefit — custom-element attributes cannot execute JS on their own,