Change HTML sanitization to remove unusable and unused `embed` tag (#34021)

2 days ago · 1a27e4e4cf
parent 7accf9aa12
commit 1a27e4e4cf
1 changed files with 2 additions and 4 deletions
--- a/lib/sanitize_ext/sanitize_config.rb
+++ b/lib/sanitize_ext/sanitize_config.rb
@ -91,19 +91,17 @@ class Sanitize
      ]
    )

-    MASTODON_OEMBED ||= freeze_config(
-      elements: %w(audio embed iframe source video),
+    MASTODON_OEMBED = freeze_config(
+      elements: %w(audio iframe source video),

      attributes: {
        'audio' => %w(controls),
-        'embed' => %w(height src type width),
        'iframe' => %w(allowfullscreen frameborder height scrolling src width),
        'source' => %w(src type),
        'video' => %w(controls height loop width),
      },

      protocols: {
-        'embed' => { 'src' => HTTP_PROTOCOLS },
        'iframe' => { 'src' => HTTP_PROTOCOLS },
        'source' => { 'src' => HTTP_PROTOCOLS },
      },