Problem/Motivation

Seems that adding captions for remote videos don't filter the caption as the formatter for images does (with an Xss::filter).

Steps to reproduce

Add a caption to a video with something susceptible of having HTML on it, like a token, the caption will have HTML tags on it.

Proposed resolution

Add a Xss::filter to the caption.

See code in this MR:
https://www.drupal.org/project/glightbox_media_video/issues/3491410

Issue fork colorbox_media_video-3491533

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

levmyshkin created an issue. See original summary.

sorabh.v6’s picture

sorabh.v6
He/His
Primary language Hindi
commented
Assigned: Unassigned » sorabh.v6

Working on it.

sorabh.v6 changed the visibility of the branch 3491533-filter-caption-for-videos to hidden.

sorabh.v6’s picture

sorabh.v6
He/His
Primary language Hindi
commented

@levmyshkin I uploaded a video on youtube for testing and added alert tag and script tag in the subtitles and they were stripped off by the youtube itself. In the formatter setting, when I added custom caption and added <alert>this is test</alert> then in the node page, I was able to see this is test only as the caption and i do not see alert tag.

I also went through the code and I do not see the need Xss::filter

levmyshkin’s picture

levmyshkin
Location Novi Sad, Serbia
commented
Status: Active » Closed (cannot reproduce)