ignored permissions

src/general.ts

@@ -84,15 +84,24 @@ async function getOEmbedPlayer($: cheerio.CheerioAPI, pageUrl: string): Promise<
 
 	// TODO: This implementation only allows basic syntax of `allow`.
 	// Might need to implement better later.
-	const allowedFeatures = (iframe.attr('allow') ?? '').split(/\s*;\s*/g).filter(s => s);
 	const safeList = [
 		'autoplay',
 		'clipboard-write',
 		'fullscreen',
 		'encrypted-media',
-		'picture-in-picture'
+		'picture-in-picture',
+		'web-share',
 	];
-	if (allowedFeatures.some(allow => !safeList.includes(allow))) {
+	// YouTube has these but they are almost never used.
+	const ignoredList = [
+		'gyroscope',
+		'accelerometer',
+	];
+	const allowedPermissions =
+		(iframe.attr('allow') ?? '').split(/\s*;\s*/g)
+			.filter(s => s)
+			.filter(s => !ignoredList.includes(s));
+	if (allowedPermissions.some(allow => !safeList.includes(allow))) {
 		// This iframe is probably too powerful to be embedded
 		return null;
 	}
@@ -101,7 +110,7 @@ async function getOEmbedPlayer($: cheerio.CheerioAPI, pageUrl: string): Promise<
 		url,
 		width,
 		height,
-		allow: allowedFeatures
+		allow: allowedPermissions
 	}
 }
 

test/index.ts

@@ -294,12 +294,24 @@ describe("oEmbed", () => {
 		await setUpFastify('oembed-allow-fullscreen.json');
 		const summary = await summaly(host);
 		expect(summary.player.url).toBe('https://example.com/');
+		expect(summary.player.allow).toStrictEqual(['fullscreen'])
 	});
 
-	test('allows safelisted features', async () => {
+	test('allows safelisted permissions', async () => {
 		await setUpFastify('oembed-allow-safelisted-features.json');
 		const summary = await summaly(host);
 		expect(summary.player.url).toBe('https://example.com/');
+		expect(summary.player.allow).toStrictEqual([
+			'autoplay', 'clipboard-write', 'fullscreen',
+			'encrypted-media', 'picture-in-picture', 'web-share',
+		]);
+	});
+
+	test('ignores rare permissions', async () => {
+		await setUpFastify('oembed-ignore-rare-features.json');
+		const summary = await summaly(host);
+		expect(summary.player.url).toBe('https://example.com/');
+		expect(summary.player.allow).toStrictEqual(['autoplay']);
 	});
 
 	test('oEmbed with relative path', async () => {

test/oembed/oembed-allow-safelisted-permissions.json

@@ -1,7 +1,7 @@
 {
   "version": "1.0",
   "type": "rich",
-  "html": "<iframe src='https://example.com/' allow='autoplay;clipboard-write;fullscreen;encrypted-media;picture-in-picture'></iframe>",
+  "html": "<iframe src='https://example.com/' allow='autoplay;clipboard-write;fullscreen;encrypted-media;picture-in-picture;web-share'></iframe>",
   "width": 500,
   "height": 300
 }

test/oembed/oembed-ignore-rare-permissions.json

@@ -0,0 +1,7 @@
+{
+  "version": "1.0",
+  "type": "rich",
+  "html": "<iframe src='https://example.com/' allow='autoplay;gyroscope;accelerometer'></iframe>",
+  "width": 500,
+  "height": 300
+}