diff --git a/plugins/compiled-markdown-directive.js b/plugins/compiled-markdown-directive.js
index 5167df656..d1e905088 100644
--- a/plugins/compiled-markdown-directive.js
+++ b/plugins/compiled-markdown-directive.js
@@ -12,12 +12,50 @@ const options = {
h4: ['id'],
h5: ['id'],
h6: ['id'],
+ iframe: ['width', 'height', 'allowfullscreen', 'frameborder'],
+ },
+ onIgnoreTagAttr: (tag, name, value) => {
+ // Allow iframes from acceptable sources
+ if (tag === 'iframe' && name === 'src') {
+ const allowedSources = [
+ {
+ regex: /^https?:\/\/(www\.)?youtube\.com\/embed\/[a-zA-Z0-9_]{11}(\?&autoplay=[0-1]{1})?$/,
+ remove: ['&autoplay=1'], // Prevents autoplay
+ },
+ ]
+
+ for (const source of allowedSources) {
+ if (source.regex.test(value)) {
+ for (const remove of source.remove) {
+ value = value.replace(remove, '')
+ }
+ return name + '="' + xss.escapeAttrValue(value) + '"'
+ }
+ }
+ }
},
}
const configuredXss = new xss.FilterXSS(options)
const headerPrefix = 'user-defined-'
+const renderer = {
+ image(href, text) {
+ if (
+ /^https?:\/\/(www\.)?youtube\.com\/watch\?v=[a-zA-Z0-9_]{11}$/.test(href)
+ ) {
+ return ``
+ } else {
+ return `
`
+ }
+ },
+}
+
+marked.use({ renderer })
+
function compileMarkdown(target, markdown) {
target.innerHTML = configuredXss.process(marked(markdown, { headerPrefix }))
}