Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

HotSpot Block- Whitelist Domain and Prevent Xss attack #109

Merged
merged 4 commits into from
Oct 10, 2024
Merged

HotSpot Block- Whitelist Domain and Prevent Xss attack #109

Changes from 2 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
bc643de
Prevent Xss attack
Oct 7, 2024
d0f26f6
Prevent Xss attack
Oct 7, 2024
9173177
Update hotspot.js
RitwikSrivastava Oct 9, 2024
d8013b9
Remove innerHtml
Oct 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 21 additions & 4 deletions blocks/hotspot/hotspot.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,10 +23,27 @@
contentContainer.appendChild(img);
} else if (isVideoVariant) {
const video = document.createElement('div');
video.innerHTML = `<div class="embed-default">
<iframe src=${content} from allow="encrypted-media" loading="lazy">
</iframe>
</div>`;
const allowedVideoDomains = ['youtube.com', 'vimeo.com', 'sidekick-library--aem-block-collection--adobe'];
try {
const url = new URL(content);
// the below code can be updated to include more video hosting sites
const domainCheck = (domain) => url.hostname.includes(domain);
const isTrustedDomain = allowedVideoDomains.some(domainCheck);
if (isTrustedDomain) {
video.innerHTML = `
<div class="embed-default">
<iframe src="${url.href}" allow="encrypted-media" loading="lazy">
</iframe>
</div>`;
} else {
console.warn('Untrusted video URL:', url.href);

Check warning on line 39 in blocks/hotspot/hotspot.js

View workflow job for this annotation

GitHub Actions / build 

Unexpected console statement
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please address linting errors.

video.textContent = 'This video source is not allowed.';
contentContainer.classList.add('bgborder');
}
} catch (e) {
console.error('Invalid video URL:', content);

Check warning on line 44 in blocks/hotspot/hotspot.js

View workflow job for this annotation

GitHub Actions / build 

Unexpected console statement
video.textContent = 'Invalid video URL.';
}
// above code can be updated for video controls such as autoplay, loop, etc.
contentContainer.appendChild(video);
} else if (isTextVariant) {
Expand Down