Sanitize and sandbox toot embeds (#9552)

2018-12-23 02:16:35 +01:00
parent bb62827c16
commit e25947db4a
2 changed files with 2 additions and 0 deletions
--- a/app/controllers/api/web/embeds_controller.rb
+++ b/app/controllers/api/web/embeds_controller.rb
@ -10,6 +10,7 @@ class Api::Web::EmbedsController < Api::Web::BaseController
    render json: status, serializer: OEmbedSerializer, width: 400
  rescue ActiveRecord::RecordNotFound
    oembed = FetchOEmbedService.new.call(params[:url])
+    oembed[:html] = Formatter.instance.sanitize(oembed[:html], Sanitize::Config::MASTODON_OEMBED) if oembed[:html].present?

    if oembed
      render json: oembed