Twitch iframes are filtered out by sanitizer

[humphd]

We need to update the sanitizer to allow the twitch iframe origin.

[joelazwar]

Am I right to assume the change should be made in of these files?

telescope/src/backend/web/app.js

Lines 23 to 29 in f20ec06

	directives: {
	defaultSrc: ["'self'"],
	fontSrc: ["'self'", 'https:', 'data:'],
	frameSrc: ["'self'", '*.youtube.com', '*.vimeo.com'],
	frameAncestors: ["'self'"],
	imgSrc: ["'self'", 'data:', 'https:'],
	scriptSrc: [

or

telescope/src/api/planet/src/index.js

Lines 14 to 19 in f20ec06

	contentSecurityPolicy: {
	directives: {
	defaultSrc: ["'self'"],
	fontSrc: ["'self'", 'https:', 'data:'],
	frameSrc: ["'self'", '*.youtube.com', '*.vimeo.com'],
	frameAncestors: ["'self'"],

[humphd]

That's for the front-end, we also need to fix https://github.com/Seneca-CDOT/telescope/blob/master/src/backend/utils/html/sanitize.js#L50-L57 in the backend. And the parser service would need this too.

[HyperTHD]

We also need to update the tests as well to ensure that this is working as intended. This is where they should go https://github.com/Seneca-CDOT/telescope/blob/master/test/sanitize-html.test.js

[HyperTHD]

Taking this

[humphd]

I'm seeing this for a second time, still unfixed. @HyperTHD do you have time to work on this, or should we give to someone else?

[HyperTHD]

I'm seeing this for a second time, still unfixed. @HyperTHD do you have time to work on this, or should we give to someone else?

Been pretty busy lately, but got some time. I'll have a PR up today hopefully for this

[manekenpix]

The issue is still there

[humphd]

Won't it need to re-index for this to get applied to that post?

[manekenpix]

@humphd oh, I forgot about that, let me make the changes on staging to see if it solves the issue

[manekenpix]

No, still the same issue

[manekenpix]

I think this is probably related to #2306 , I see the same behaviour in both cases.

[DukeManh]

Could be because the hostname is supposed to be player.twitch.tv vs twtich.tv
@HyperTHD

[DukeManh]

This is Alex's twitch iframe

<iframe src="https://player.twitch.tv/?video=1303803789&amp;parent=dev.to&amp;autoplay=false" allowfullscreen="true" scrolling="no" width="710" height="399" frameborder="0">
</iframe>

[HyperTHD]

This is Alex's twitch iframe

<iframe src="https://player.twitch.tv/?video=1303803789&amp;parent=dev.to&amp;autoplay=false" allowfullscreen="true" scrolling="no" width="710" height="399" frameborder="0">
</iframe>

I tested that hostname, still not viewing it locally

[humphd]

For me on staging, I don't get a URL on the iframe, what am I missing? Did we try re-indexing?

[manekenpix]

@humphd yes, all the feeds were re-indexed on staging, but the issue persists.

[humphd]

@HyperTHD I'd say that it's the sanitizer using 'www.twitch.tv' vs. 'player.twitch.tv' and stripping it during parsing.

[HyperTHD]

I'm not able to see any changes when switching it out, but I can put up a PR to fix this, and hopefully re-indexing on staging will fix that