Welcome! » Log In » Create A New Profile

Universal filter for third-party content embedding

Posted by s.fomin 
Universal filter for third-party content embedding
December 17, 2012 01:43PM

Hi there!

I was thinking about third-party content embedding (YouTube videos, <object>, <iframe> etc).

Am i right that there is no universal solutions for this task right now?

Is this solution demanded by the developers and users?

I though maybe i should create a universal configurable filter to accomplish this task.

Who's interested? I'm looking for your opinion. Feature requests and any ideas are most welcome.

We can even start an "official" whitelist of popular services.

Slava Fomin II

Let's make this World a Better place!

Re: Universal filter for third-party content embedding
December 18, 2012 05:12AM

This area has always been a bit of a UI disaster for HTML Purifier; I don’t think it’s a technology problem since at least for objects and iframes there exist all of the knobs for enabling them on a case-by-case basis.

Re: Universal filter for third-party content embedding
December 18, 2012 08:16AM

I've created a basic plugin i was talking about.

It's constant URL will be: https://github.com/betsol/htmlpurifier

It's only a basic version, but i think it's ready enough to be used. Edward, i will really appreciate if you could take a look at my implementation for possible bugs, security, architectural or conceptional considerations.

I hope it will be useful for developers out there. And of course i would love to maintain it and implement new features according to requests and feedback.

Can you detail how to implement this plugin. I am new to HTML Purifier and I was looking for a solution to allow youtube and google maps which this plugin looks like it will do. I went to GitHub but I don't understand what needs to be done to integrate this with HTML Purifier. How do I call it from HTML Purifier? Is there something I need to put into the config file?

Re: Universal filter for third-party content embedding
February 12, 2013 04:17PM

YouTube is currently using iframes for it's embedding code, so this plugin can help you. Don't know about Google Maps though.

Please see the README on the plugin's GitHub page - it contains all the info and examples for you to start using this plugin. I hope it will help you.

If you have any specific questions/ideas, i will be glad to help/discuss them. Thanks!

Slava Fomin II

Let's make this World a Better place!

Re: Universal filter for third-party content embedding
February 12, 2013 08:36PM

http://htmlpurifier.org/live/configdoc/plain.html#URI.SafeIframeRegexp

URI.SafeIframeRegexp works fine for youtube, vimeo, google etc using iframes.

not sure about googlemaps, but i think it should.

i've looked through your filter & it looks ok to me, security wise it is sound.

i have 1 question tho, I haven't tested it, but noticing the usage of parse_url() in the filter,

wouldn't this cause issues with people using relative urls? as I said, i haven't tested the plugin, just looked through the source.

json is a bit overkill imo & requires UTF8 (might cause issues for other encodings), but nonetheless, it looks good.

nice job.

ImpressCMS: Make A Lasting Impression

Edited 1 time(s). Last edit at 02/12/2013 09:28PM by vaughan.

Re: Universal filter for third-party content embedding
February 13, 2013 03:07AM

Thanks for your reply Vaughan!

The things you are talking about really makes sense to me. I will test for specified issues and consider to improve the code.

You probably right about JSON format. What can you suggest to replace JSON with? Will serialize do?

Slava Fomin II

Let's make this World a Better place!

Re: Universal filter for third-party content embedding
February 13, 2013 07:55AM

i think serialize should be fine looking at it.

ImpressCMS: Make A Lasting Impression

Sorry, you do not have permission to post/reply in this forum.