collective / collective/sc.embedder
Check html is an iframe if not wrap it
Open
- Dominant language
- JavaScript
- Stars
- 3
- Forks
- 7
- PR merge metrics
- No merged PRs in 30d
Description
Just noting this security consideration from the [oembed spec](http://oembed.com/#section3) before I forget...
"When a consumer displays HTML (as with video embeds), there's a vector for XSS attacks from the provider. To avoid this, it is recommended that consumers display the HTML in an iframe, hosted from another domain. This ensures that the HTML cannot access cookies from the consumer domain."
(unless this is handled in your dependencies?)
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.