diff --git a/app/assets/javascripts/discourse/tests/unit/lib/sanitizer-test.js b/app/assets/javascripts/discourse/tests/unit/lib/sanitizer-test.js index ea7898f33cd..aa0efbf80e3 100644 --- a/app/assets/javascripts/discourse/tests/unit/lib/sanitizer-test.js +++ b/app/assets/javascripts/discourse/tests/unit/lib/sanitizer-test.js @@ -168,6 +168,38 @@ module("Unit | Utility | sanitizer", function () { ); }); + test("autoplay videos must be muted", function (assert) { + let pt = new PrettyText(buildOptions({ siteSettings: {} })); + assert.ok( + pt + .sanitize( + `
Hey
` + ) + .match(/muted/) + ); + assert.ok( + pt + .sanitize( + `Hey
` + ) + .match(/muted/) + ); + assert.ok( + pt + .sanitize( + `Hey
` + ) + .match(/muted/) + ); + assert.notOk( + pt + .sanitize( + `Hey
` + ) + .match(/muted/) + ); + }); + test("poorly formed ids on headings", function (assert) { let pt = new PrettyText(buildOptions({ siteSettings: {} })); assert.equal( diff --git a/app/assets/javascripts/pretty-text/addon/allow-lister.js b/app/assets/javascripts/pretty-text/addon/allow-lister.js index 1844702b6ec..930edc704a3 100644 --- a/app/assets/javascripts/pretty-text/addon/allow-lister.js +++ b/app/assets/javascripts/pretty-text/addon/allow-lister.js @@ -225,7 +225,7 @@ export const DEFAULT_LIST = [ "track[srclang]", "ul", "video", - "video[autoplay]", + // video[autoplay] handled by sanitizer.js "video[controls]", "video[controlslist]", "video[crossorigin]", diff --git a/app/assets/javascripts/pretty-text/addon/sanitizer.js b/app/assets/javascripts/pretty-text/addon/sanitizer.js index 23eea075e14..f29c37b80f5 100644 --- a/app/assets/javascripts/pretty-text/addon/sanitizer.js +++ b/app/assets/javascripts/pretty-text/addon/sanitizer.js @@ -126,6 +126,12 @@ export function sanitize(text, allowLister) { return "-STRIP-"; } + if (tag === "video" && name === "autoplay") { + // This might give us duplicate 'muted' atttributes + // but they will be deduped by later processing + return "autoplay muted"; + } + // Heading ids must begin with `heading--` if ( ["h1", "h2", "h3", "h4", "h5", "h6"].indexOf(tag) !== -1 &&