Changeset a85f539 in Klonkt for src/services/HtmlSanitizerService.js

Timestamp:

07/16/2026 12:20:51 PM (8 weeks ago)

Author:

Robin <roboburr@…>

Branches:

main

Children:

e276d03

Parents:

8e7f0ec

git-author:

Robin <roboburr@…> (07/12/2026 10:30:07 PM)

git-committer:

Robin <roboburr@…> (07/16/2026 12:20:51 PM)

Message:

Fix: bare .webm/.mp4/.mp3 URLs render a native player

autoembed() and [[embed:]] now detect direct media-file URLs and emit a
<video>/<audio> element (was: left as a plain link). Sanitizer allows
video/audio/source with a tight attr + http(s)-scheme allowlist so
hand-authored and federated-in players survive. detectProvider() is left
untouched so the timeline/cover callers that switch on provider slugs are
unaffected.

Co-Authored-By: Claude Opus 4.8 <noreply@…>

File:

• src/services/HtmlSanitizerService.js (modified) (1 diff)

src/services/HtmlSanitizerService.js

@@ -25 +25 @@
   'strong', 'em', 'b', 'i', 'u', 's', 'mark', 'small', 'sub', 'sup',
   'code', 'a', 'span', 'img',
+  // Native media (bare .webm/.mp4/.mp3 embeds + federated-in players)
+  'video', 'audio', 'source',
 ];
 
 // Per-tag attribute allowlist. '*' applies to every tag.
 const ALLOWED_ATTRS = {
-  '*': ['class', 'id', 'dir', 'lang', 'data-sc'],
-  a:   ['href', 'title', 'target', 'rel'],
-  img: ['src', 'alt', 'title', 'width', 'height', 'loading'],
+  '*':   ['class', 'id', 'dir', 'lang', 'data-sc'],
+  a:     ['href', 'title', 'target', 'rel'],
+  img:   ['src', 'alt', 'title', 'width', 'height', 'loading'],
+  video: ['src', 'controls', 'preload', 'poster', 'width', 'height', 'loop', 'muted', 'autoplay', 'playsinline'],
+  audio: ['src', 'controls', 'preload', 'loop', 'muted', 'autoplay'],
+  source: ['src', 'type'],
 };
 
 const ALLOWED_SCHEMES = ['http', 'https', 'mailto', 'tel'];
 const ALLOWED_SCHEMES_BY_TAG = {
-  img: ['http', 'https', 'data'],
-  a:   ['http', 'https', 'mailto', 'tel'],
+  img:    ['http', 'https', 'data'],
+  a:      ['http', 'https', 'mailto', 'tel'],
+  video:  ['http', 'https'],
+  audio:  ['http', 'https'],
+  source: ['http', 'https'],
 };