Merge pull request #267 from tms/onebox-safety
Tighten up onebox rendering
This commit is contained in:
Robin Ward
commit
465772df72
|
|
@ -31,11 +31,14 @@ module Oneboxer
|
|||
oneboxer = onebox_for_url(url)
|
||||
return oneboxer.onebox if oneboxer.present?
|
||||
|
||||
if Whitelist.allowed?(url)
|
||||
whitelist_entry = Whitelist.entry_for_url(url)
|
||||
|
||||
if whitelist_entry.present?
|
||||
page_html = open(url).read
|
||||
if page_html.present?
|
||||
doc = Nokogiri::HTML(page_html)
|
||||
|
||||
if whitelist_entry.allows_oembed?
|
||||
# See if if it has an oembed thing we can use
|
||||
(doc/"link[@type='application/json+oembed']").each do |oembed|
|
||||
return OembedOnebox.new(oembed[:href]).onebox
|
||||
|
|
@ -43,6 +46,7 @@ module Oneboxer
|
|||
(doc/"link[@type='text/json+oembed']").each do |oembed|
|
||||
return OembedOnebox.new(oembed[:href]).onebox
|
||||
end
|
||||
end
|
||||
|
||||
# Check for opengraph
|
||||
open_graph = Oneboxer.parse_open_graph(doc)
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@ require_dependency 'oneboxer/oembed_onebox'
|
|||
module Oneboxer
|
||||
class ClikthroughOnebox < OembedOnebox
|
||||
|
||||
matcher /clikthrough\.com\/theater\/video\/\d+$/
|
||||
matcher /^https?:\/\/(?:www\.)?clikthrough\.com\/theater\/video\/\d+$/
|
||||
|
||||
def oembed_endpoint
|
||||
"http://clikthrough.com/services/oembed?url=#{BaseOnebox.uriencode(@url)}"
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@ require_dependency 'oneboxer/oembed_onebox'
|
|||
module Oneboxer
|
||||
class DailymotionOnebox < OembedOnebox
|
||||
|
||||
matcher /dailymotion\.com\/.+$/
|
||||
matcher /^https?:\/\/(?:www\.)?dailymotion\.com\/.+$/
|
||||
|
||||
def oembed_endpoint
|
||||
"http://www.dailymotion.com/api/oembed/?url=#{BaseOnebox.uriencode(@url)}"
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@ require_dependency 'oneboxer/oembed_onebox'
|
|||
module Oneboxer
|
||||
class DotsubOnebox < OembedOnebox
|
||||
|
||||
matcher /dotsub\.com\/.+$/
|
||||
matcher /^https?:\/\/(?:www\.)?dotsub\.com\/.+$/
|
||||
|
||||
def oembed_endpoint
|
||||
"http://dotsub.com/services/oembed?url=#{BaseOnebox.uriencode(@url)}"
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@ require_dependency 'oneboxer/handlebars_onebox'
|
|||
module Oneboxer
|
||||
class GithubBlobOnebox < HandlebarsOnebox
|
||||
|
||||
matcher /github\.com\/[^\/]+\/[^\/]+\/blob\/.*/
|
||||
matcher /^https?:\/\/(?:www\.)?github\.com\/[^\/]+\/[^\/]+\/blob\/.*/
|
||||
favicon 'github.png'
|
||||
|
||||
def translate_url
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@ require_dependency 'oneboxer/oembed_onebox'
|
|||
module Oneboxer
|
||||
class KinomapOnebox < OembedOnebox
|
||||
|
||||
matcher /kinomap\.com/
|
||||
matcher /^https?:\/\/(?:www\.)?kinomap\.com/
|
||||
|
||||
def oembed_endpoint
|
||||
"http://www.kinomap.com/oembed?url=#{BaseOnebox.uriencode(@url)}&format=json"
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@ require_dependency 'oneboxer/oembed_onebox'
|
|||
module Oneboxer
|
||||
class NfbOnebox < OembedOnebox
|
||||
|
||||
matcher /nfb\.ca\/film\/[-\w]+\/?/
|
||||
matcher /^https?:\/\/(?:www\.)?nfb\.ca\/film\/[-\w]+\/?/
|
||||
|
||||
def oembed_endpoint
|
||||
"http://www.nfb.ca/remote/services/oembed/?url=#{BaseOnebox.uriencode(@url)}&format=json"
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@ require_dependency 'oneboxer/oembed_onebox'
|
|||
module Oneboxer
|
||||
class ViddlerOnebox < OembedOnebox
|
||||
|
||||
matcher /viddler\.com\/.+$/
|
||||
matcher /^https?:\/\/(?:www\.)?viddler\.com\/.+$/
|
||||
|
||||
def oembed_endpoint
|
||||
"http://lab.viddler.com/services/oembed/?url=#{BaseOnebox.uriencode(@url)}"
|
||||
|
|
|
|||
|
|
@ -2,84 +2,102 @@ module Oneboxer
|
|||
|
||||
module Whitelist
|
||||
def self.entries
|
||||
[/cnn\.com\/.+/,
|
||||
/washingtonpost\.com\/.+/,
|
||||
/\/\d{4}\/\d{2}\/\d{2}\//, # wordpress
|
||||
/funnyordie\.com\/.+/,
|
||||
/youtube\.com\/.+/,
|
||||
/youtu\.be\/.+/,
|
||||
/500px\.com\/.+/,
|
||||
/scribd\.com\/.+/,
|
||||
/photobucket\.com\/.+/,
|
||||
/ebay\.(com|ca|co\.uk)\/.+/,
|
||||
/nytimes\.com\/.+/,
|
||||
/tumblr\.com\/.+/,
|
||||
/pinterest\.com\/.+/,
|
||||
/imdb\.com\/.+/,
|
||||
/bbc\.co\.uk\/.+/,
|
||||
/ask\.com\/.+/,
|
||||
/huffingtonpost\.com\/.+/,
|
||||
/aol\.(com|ca)\/.+/,
|
||||
/espn\.go\.com\/.+/,
|
||||
/about\.com\/.+/,
|
||||
/cnet\.com\/.+/,
|
||||
/ehow\.com\/.+/,
|
||||
/dailymail\.co\.uk\/.+/,
|
||||
/indiatimes\.com\/.+/,
|
||||
/answers\.com\/.+/,
|
||||
/instagr\.am\/.+/,
|
||||
/battle\.net\/.+/,
|
||||
/sourceforge\.net\/.+/,
|
||||
/myspace\.com\/.+/,
|
||||
/wikia\.com\/.+/,
|
||||
/etsy\.com\/.+/,
|
||||
/walmart\.com\/.+/,
|
||||
/reference\.com\/.+/,
|
||||
/yelp\.com\/.+/,
|
||||
/foxnews\.com\/.+/,
|
||||
/guardian\.co\.uk\/.+/,
|
||||
/digg\.com\/.+/,
|
||||
/squidoo\.com\/.+/,
|
||||
/wsj\.com\/.+/,
|
||||
/archive\.org\/.+/,
|
||||
/nba\.com\/.+/,
|
||||
/samsung\.com\/.+/,
|
||||
/mashable\.com\/.+/,
|
||||
/forbes\.com\/.+/,
|
||||
/soundcloud\.com\/.+/,
|
||||
/thefreedictionary\.com\/.+/,
|
||||
/groupon\.com\/.+/,
|
||||
/ikea\.com\/.+/,
|
||||
/dell\.com\/.+/,
|
||||
/mlb\.com\/.+/,
|
||||
/bestbuy\.(com|ca)\/.+/,
|
||||
/bloomberg\.com\/.+/,
|
||||
/ign\.com\/.+/,
|
||||
/twitpic\.com\/.+/,
|
||||
/techcrunch\.com\/.+/,
|
||||
/usatoday\.com\/.+/,
|
||||
/go\.com\/.+/,
|
||||
/businessinsider\.com\/.+/,
|
||||
/zillow\.com\/.+/,
|
||||
/tmz\.com\/.+/,
|
||||
/thesun\.co\.uk\/.+/,
|
||||
/thestar\.(com|ca)\/.+/,
|
||||
/theglobeandmail\.com\/.+/,
|
||||
/torontosun\.com\/.+/,
|
||||
/kickstarter\.com\/.+/,
|
||||
/wired\.com\/.+/,
|
||||
/time\.com\/.+/,
|
||||
/npr\.org\/.+/,
|
||||
/cracked\.com\/.+/,
|
||||
/thinkgeek\.com\/.+/,
|
||||
/deadline\.com\/.+/
|
||||
[
|
||||
Entry.new(/^https?:\/\/(?:www\.)?cnn\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?washingtonpost\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?funnyordie\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?youtube\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?youtu\.be\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?500px\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?scribd\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?photobucket\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?ebay\.(com|ca|co\.uk)\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?nytimes\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?pinterest\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?imdb\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?bbc\.co\.uk\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?ask\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?huffingtonpost\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?aol\.(com|ca)\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?espn\.go\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?about\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?cnet\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?ehow\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?dailymail\.co\.uk\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?indiatimes\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?answers\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?instagr\.am\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?battle\.net\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?sourceforge\.net\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?myspace\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?wikia\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?etsy\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?walmart\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?reference\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?yelp\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?foxnews\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?guardian\.co\.uk\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?digg\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?squidoo\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?wsj\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?archive\.org\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?nba\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?samsung\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?mashable\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?forbes\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?soundcloud\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?thefreedictionary\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?groupon\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?ikea\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?dell\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?mlb\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?bestbuy\.(com|ca)\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?bloomberg\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?ign\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?twitpic\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?techcrunch\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?usatoday\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?go\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?businessinsider\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?zillow\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?tmz\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?thesun\.co\.uk\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?thestar\.(com|ca)\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?theglobeandmail\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?torontosun\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?kickstarter\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?wired\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?time\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?npr\.org\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?cracked\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?deadline\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?thinkgeek\.com\/.+/),
|
||||
Entry.new(/^https?:\/\/(?:www\.)?tumblr\.com\/.+/, false),
|
||||
Entry.new(/\/\d{4}\/\d{2}\/\d{2}\//, false), # wordpress
|
||||
]
|
||||
end
|
||||
|
||||
def self.allowed?(url)
|
||||
#return true
|
||||
entries.each {|e| return true if url =~ e }
|
||||
false
|
||||
def self.entry_for_url(url)
|
||||
entries.each {|e| return e if e.matches?(url) }
|
||||
nil
|
||||
end
|
||||
|
||||
private
|
||||
|
||||
class Entry
|
||||
# oembed = false is probably safer, but this is the least-drastic change
|
||||
def initialize(pattern, oembed = true)
|
||||
@pattern = pattern
|
||||
@oembed = oembed
|
||||
end
|
||||
|
||||
def allows_oembed?
|
||||
@oembed
|
||||
end
|
||||
|
||||
def matches?(url)
|
||||
url =~ @pattern
|
||||
end
|
||||
end
|
||||
|
||||
end
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@ require_dependency 'oneboxer/oembed_onebox'
|
|||
module Oneboxer
|
||||
class YfrogOnebox < OembedOnebox
|
||||
|
||||
matcher /yfrog\.(com|ru|com\.tr|it|fr|co\.il|co\.uk|com\.pl|pl|eu|us)\/[a-zA-Z0-9]+/
|
||||
matcher /^https?:\/\/(?:www\.)?yfrog\.(com|ru|com\.tr|it|fr|co\.il|co\.uk|com\.pl|pl|eu|us)\/[a-zA-Z0-9]+/
|
||||
|
||||
def oembed_endpoint
|
||||
"http://www.yfrog.com/api/oembed/?url=#{BaseOnebox.uriencode(@url)}&format=json"
|
||||
|
|
|
|||
Loading…
Reference in New Issue