misskey-dev/summerflare
1
0
Fork 0
mirror of https://github.com/misskey-dev/summerflare.git synced 2025-04-29 02:37:17 +09:00
Code Issues Packages Projects Releases Wiki Activity

fix: safe allow

Browse Source
This commit is contained in:
Acid Chicken (硫酸鶏) 2024-06-01 19:09:55 +09:00
parent c521b2482a
commit dab9296da8
No known key found for this signature in database
GPG Key ID: 3E87B98A3F6BAB99
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/summary/general/playerOEmbed.ts
View File

@ -84,8 +84,12 @@ export default function getPlayerOEmbed(context: Context) {
decode(allowValue)
?.replace(/^\s*|\s*$/g, "")
.split(/\s*;\s*/)
.filter((value) => value !== "accelerometer" && value !== "gyroscope")
.sort()) ||
[]
if (allow.some((value) => value !== "autoplay" && value !== "clipboard-write" && value !== "encrypted-media" && value !== "fullscreen" && value !== "picture-in-picture" && value !== "web-share")) {
return
}
const srcValue = element.getAttribute("src")
const src = srcValue ? decode(srcValue) : null
switch (data.type) {