The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.When comparing content using the Visual Inline diff layout embedded remote videos are stripped out by HtmlDiffAdvanced
The core media module embeds these remote videos using oEmbed and an iframe <iframe src="/media/oembed?url=...
Displaying media assets from third-party services, such as YouTube or Twitter, can be risky. This is because many of these services return arbitrary HTML to represent those assets, and that HTML may contain executable JavaScript code. If handled improperly, this can increase the risk of your site being compromised.
In order to mitigate the risks, third-party assets are displayed in an iFrame, which effectively sandboxes any executable code running inside it. For even more security, the iFrame can be served from an alternate domain (that also points to your Drupal site), which you can configure on this page. This helps safeguard cookies and other sensitive information.
HtmlDiffAdvanced strips out the iframe completely.
HtmlDiffAdvanced has functions setSpecialCaseTags & addSpecialCaseTag which would allow the iframe to be added as a safe tag, but I think it would be better to take the config from Allowed HTML tags if the Limit allowed HTML tags and correct faulty HTML tags filter is enabled in the text format.
Comments
Comment #2
luke.leberIt looks like HTMLPurifier itself is what's doing the stripping and whatnot.
Perhaps the diff module could add a feature that could allow the end user to either control or influence the HTMLPurifier configuration.
For example, the default purifier even seems to strip out
<picture>, and<source>, and<form>tags amongst other things.Comment #3
bkosborneYes we should probably have a hook to allow HTML Purifier to be configured by other modules, or just deploy more sensible default configs.