diff options
| -rw-r--r-- | reader/sanitizer/sanitizer.go | 2 | ||||
| -rw-r--r-- | reader/sanitizer/sanitizer_test.go | 12 |
2 files changed, 7 insertions, 7 deletions
diff --git a/reader/sanitizer/sanitizer.go b/reader/sanitizer/sanitizer.go index eae9b21..1065e5b 100644 --- a/reader/sanitizer/sanitizer.go +++ b/reader/sanitizer/sanitizer.go @@ -137,7 +137,7 @@ func getExtraAttributes(tagName string) ([]string, []string) { case "video", "audio": return []string{"controls"}, []string{"controls"} case "iframe": - return []string{"sandbox"}, []string{`sandbox="allow-scripts allow-same-origin"`} + return []string{"sandbox"}, []string{`sandbox="allow-scripts allow-same-origin allow-popups"`} default: return nil, nil } diff --git a/reader/sanitizer/sanitizer_test.go b/reader/sanitizer/sanitizer_test.go index b6588f0..57769dd 100644 --- a/reader/sanitizer/sanitizer_test.go +++ b/reader/sanitizer/sanitizer_test.go @@ -165,7 +165,7 @@ func TestEspaceAttributes(t *testing.T) { func TestReplaceYoutubeURL(t *testing.T) { input := `<iframe src="http://www.youtube.com/embed/test123?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent"></iframe>` - expected := `<iframe src="https://www.youtube-nocookie.com/embed/test123?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent" sandbox="allow-scripts allow-same-origin"></iframe>` + expected := `<iframe src="https://www.youtube-nocookie.com/embed/test123?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent" sandbox="allow-scripts allow-same-origin allow-popups"></iframe>` output := Sanitize("http://example.org/", input) if expected != output { @@ -175,7 +175,7 @@ func TestReplaceYoutubeURL(t *testing.T) { func TestReplaceSecureYoutubeURL(t *testing.T) { input := `<iframe src="https://www.youtube.com/embed/test123"></iframe>` - expected := `<iframe src="https://www.youtube-nocookie.com/embed/test123" sandbox="allow-scripts allow-same-origin"></iframe>` + expected := `<iframe src="https://www.youtube-nocookie.com/embed/test123" sandbox="allow-scripts allow-same-origin allow-popups"></iframe>` output := Sanitize("http://example.org/", input) if expected != output { @@ -185,7 +185,7 @@ func TestReplaceSecureYoutubeURL(t *testing.T) { func TestReplaceSecureYoutubeURLWithParameters(t *testing.T) { input := `<iframe src="https://www.youtube.com/embed/test123?rel=0&controls=0"></iframe>` - expected := `<iframe src="https://www.youtube-nocookie.com/embed/test123?rel=0&controls=0" sandbox="allow-scripts allow-same-origin"></iframe>` + expected := `<iframe src="https://www.youtube-nocookie.com/embed/test123?rel=0&controls=0" sandbox="allow-scripts allow-same-origin allow-popups"></iframe>` output := Sanitize("http://example.org/", input) if expected != output { @@ -195,7 +195,7 @@ func TestReplaceSecureYoutubeURLWithParameters(t *testing.T) { func TestReplaceYoutubeURLAlreadyReplaced(t *testing.T) { input := `<iframe src="https://www.youtube-nocookie.com/embed/test123?rel=0&controls=0" sandbox="allow-scripts allow-same-origin"></iframe>` - expected := `<iframe src="https://www.youtube-nocookie.com/embed/test123?rel=0&controls=0" sandbox="allow-scripts allow-same-origin"></iframe>` + expected := `<iframe src="https://www.youtube-nocookie.com/embed/test123?rel=0&controls=0" sandbox="allow-scripts allow-same-origin allow-popups"></iframe>` output := Sanitize("http://example.org/", input) if expected != output { @@ -205,7 +205,7 @@ func TestReplaceYoutubeURLAlreadyReplaced(t *testing.T) { func TestReplaceProtocolRelativeYoutubeURL(t *testing.T) { input := `<iframe src="//www.youtube.com/embed/Bf2W84jrGqs" width="560" height="314" allowfullscreen="allowfullscreen"></iframe>` - expected := `<iframe src="https://www.youtube-nocookie.com/embed/Bf2W84jrGqs" width="560" height="314" allowfullscreen="allowfullscreen" sandbox="allow-scripts allow-same-origin"></iframe>` + expected := `<iframe src="https://www.youtube-nocookie.com/embed/Bf2W84jrGqs" width="560" height="314" allowfullscreen="allowfullscreen" sandbox="allow-scripts allow-same-origin allow-popups"></iframe>` output := Sanitize("http://example.org/", input) if expected != output { @@ -215,7 +215,7 @@ func TestReplaceProtocolRelativeYoutubeURL(t *testing.T) { func TestReplaceIframeURL(t *testing.T) { input := `<iframe src="https://player.vimeo.com/video/123456?title=0&byline=0"></iframe>` - expected := `<iframe src="https://player.vimeo.com/video/123456?title=0&byline=0" sandbox="allow-scripts allow-same-origin"></iframe>` + expected := `<iframe src="https://player.vimeo.com/video/123456?title=0&byline=0" sandbox="allow-scripts allow-same-origin allow-popups"></iframe>` output := Sanitize("http://example.org/", input) if expected != output { |