IntenseWebs/discourse
3
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-11 05:25:16 -05:00
Code Issues Packages Projects Releases Wiki Activity

FIX: escape youtube title when constructing onebox preview html (#16999)

Browse Source
This commit is contained in:
Mayfield
2022-06-08 13:42:37 +08:00
committed by GitHub
parent 82ac698d4f
commit 99b0578b4c
2 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
spec/lib/oneboxer_spec.rb
+6 -1
View File
@@ -384,7 +384,7 @@ describe Oneboxer do
<<~HTML
<html>
<head>
<meta property="og:title" content="Onebox1">
<meta property="og:title" content="Onebox1 - ceci n'est pas un titre">
<meta property="og:description" content="this is bodycontent">
<meta property="og:image" content="https://i.ytimg.com/vi/dQw4w9WgXcQ/maxresdefault.jpg">
</head>
@@ -416,6 +416,11 @@ describe Oneboxer do
output = Oneboxer.onebox("https://www.youtube.com/watch?v=dQw4w9WgXcQ", invalidate_oneboxes: true)
expect(output).to include("<iframe") # Regular youtube onebox
end
it "appropriately escapes youtube titles" do
preview = Oneboxer.preview("https://www.youtube.com/watch?v=dQw4w9WgXcQ", invalidate_oneboxes: true)
expect(preview).to include("ceci n'est pas un titre")
end
end
it "allows iframes from generic sites via the allowed_iframes setting" do