From 29b3b3db307cdc6181744db18ce4d73540d63216 Mon Sep 17 00:00:00 2001
From: Samuel Newman <mozzius@protonmail.com>
Date: Wed, 27 Nov 2024 19:19:36 +0000
Subject: YT embed tweak (#6789)

* tweak css

* fix typo

* More tweak

---------

Co-authored-by: Dan Abramov <dan.abramov@gmail.com>
---
 bskyweb/static/iframe/youtube.html | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

(limited to 'bskyweb')

diff --git a/bskyweb/static/iframe/youtube.html b/bskyweb/static/iframe/youtube.html
index 4b74d6fcd..a717a67c6 100644
--- a/bskyweb/static/iframe/youtube.html
+++ b/bskyweb/static/iframe/youtube.html
@@ -27,13 +27,21 @@
 
   let player
   function onYouTubeIframeAPIReady() {
+    let videoId = url.searchParams.get('videoId')
+    videoId = decodeURIComponent(videoId)
+    videoId = videoId.replace(/[^a-zA-Z0-9_-]/g, "")
+    if (videoId.length !== 11) throw new Error("Invalid video ID")
+
+    let start = url.searchParams.get('start')
+    start = start.replace(/[^0-9]/g, "")
+
     player = new YT.Player('player', {
       width: "1000",
       height: "1000",
-      videoId: url.searchParams.get('videoId'),
+      videoId,
       playerVars: {
         autoplay: 1,
-        start: url.searchParams.get('start'),
+        start,
         rel: 0,
         loop: 0,
         playsinline: 1,
-- 
cgit 1.4.1