nocebo/diaspora
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

some restructuring around oembed providers

Browse source
This commit is contained in:
Florian Staudacher 2012-03-15 18:34:47 +01:00
parent f1a0055a80
commit e6b403434f
2 changed files with 12 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
app/models/status_message.rb
View file

@ -157,7 +157,7 @@ class StatusMessage < Post
def contains_oembed_url_in_text? def contains_oembed_url_in_text?
require 'uri' require 'uri'
urls = URI.extract(self.raw_message, ['http', 'https']) urls = URI.extract(self.raw_message, ['http', 'https'])
self.oembed_url = urls.find{|url| ENDPOINT_HOSTS_STRING.match(URI.parse(url).host)} self.oembed_url = urls.find{ |url| !TRUSTED_OEMBED_PROVIDERS.find(url).nil? }
end end
protected protected

18
config/initializers/oembed.rb
View file

@ -1,16 +1,20 @@
require 'oembed' require 'oembed'
require 'uri' require 'uri'
OEmbed::Providers.register_all OEmbedCubbies = OEmbed::Provider.new("http://cubbi.es/oembed")
OEmbed::Providers.register(
OEmbed::Providers::Youtube,
OEmbed::Providers::Vimeo,
OEmbed::Providers::Flickr,
OEmbed::Providers::SoundCloud,
OEmbedCubbies
)
OEmbed::Providers.register_fallback(OEmbed::ProviderDiscovery) OEmbed::Providers.register_fallback(OEmbed::ProviderDiscovery)
# #
# SECURITY NOTICE! CROSS-SITE SCRIPTING! # SECURITY NOTICE! CROSS-SITE SCRIPTING!
# these endpoints may inject html code into our page # these endpoints may inject html code into our page
# note that 'trusted_endpoint_url' is the only information # note that 'trusted_endpoint_url' is the only information
# in OEmbed that we can trust. anything else may be spoofed! # in OEmbed that we can trust. anything else may be spoofed!
SECURE_ENDPOINTS = [::OEmbed::Providers::Youtube.endpoint, TRUSTED_OEMBED_PROVIDERS = OEmbed::Providers
::OEmbed::Providers::Flickr.endpoint,
'http://soundcloud.com/oembed',
'http://cubbi.es/oembed'
]
ENDPOINT_HOSTS_STRING = SECURE_ENDPOINTS.map{|e| URI.parse(e.split('{')[0]).host}.to_s