I have following config in my antisamy policy file:
Old YouTube Object:
<object width="1280" height="720">
<param
name="movie"
value="http://www.youtube.com/v/Hl-zzrqQoSE
?version=3
&hl=en_US
&rel=0">
</param>
<param name="allowFullScreen" value="true">
</param>
<param name="allowscriptaccess" value="always">
</param>
<embed src="http://www.youtube.com/v/Hl-zzrqQoSE
?version=3
&hl=en_US
&rel=0"
type="application/x-shockwave-flash"
width="1280"
height="720"
allowscriptaccess="always"
allowfullscreen="true">
</embed>
</object>
The AntiSamy config:
<common-regexps>
<regexp name="YouTubeURL" value="(\s)*(http(s?)://)www.youtube.com/v/[\p{L}\p{N}]+[\p{L}\p{N}\p{Zs}\.\#@\$%\+&;:\-_~,\?=/!]*(\s)*"/>
....
<!-- Tags related to YouTube -->
<tag name="object" action="validate">
<attribute name="height"/>
<attribute name="width"/>
<attribute name="type">
<literal-list>
<literal value="application/x-shockwave-flash"/>
</literal-list>
</attribute>
<attribute name="data">
<regexp-list>
<regexp name="YouTubeURL"/>
</regexp-list>
</attribute>
</tag>
<tag name="embed" action="validate">
<attribute name="height"/>
<attribute name="width"/>
<attribute name="type">
<literal-list>
<literal value="application/x-shockwave-flash"/>
</literal-list>
</attribute>
<attribute name="allowfullscreen">
<regexp-list>
<regexp name="boolean"/>
</regexp-list>
</attribute>
<attribute name="allowscriptaccess">
<literal-list>
<literal value="always"/>
</literal-list>
</attribute>
<attribute name="src">
<regexp-list>
<regexp name="YouTubeURL"/>
</regexp-list>
</attribute>
<attribute name="movie">
<regexp-list>
<regexp name="YouTubeURL"/>
</regexp-list>
</attribute>
</tag>
Currently my config on iframe:
<!-- Frame & related tags --&g开发者_StackOverflowt;
<tag name="iframe" action="remove"/>
<tag name="frameset" action="remove"/>
<tag name="frame" action="remove"/>
The new YouTube iframe:
<iframe
width="1280"
height="720"
<!-- src="https://www.youtube-nocookie.com/embed/Hl-zzrqQoSE" -->
src="https://www.youtube.com/embed/Hl-zzrqQoSE"
frameborder="0"
allowfullscreen>
</iframe>
I figure the code for iframe should like this:
<tag name="iframe" action="validate">
<attribute name="height"/>
<attribute name="width"/>
<attribute name="frameborder"/>
<attribute name="src">
<regexp-list>
<regexp name="YouTubeURL"/>
</regexp-list>
</attribute>
<attribute name="allowfullscreen">
<regexp-list>
<regexp name="boolean"/>
</regexp-list>
</attribute>
</tag>
How do you change the regex so it will accept the old and new links like:
https://www.youtube-nocookie.com/embed/Hl-zzrqQoSE
https://www.youtube.com/embed/Hl-zzrqQoSE
https://www.youtube.com/v/Hl-zzrqQoSE
http://www.youtube-nocookie.com/v/Hl-zzrqQoSE?version=3&hl=en_US&rel=0
http://www.youtube.com/v/Hl-zzrqQoSE?version=3&hl=en_US&rel=0"
\s*(https?://)www.youtube(-nocookie)?.com/(?:v|embed)/[\p{L}\p{N}]+[\p{L}\p{N}\p{Zs}.#@$%+&;:_~,?=!/-]*\s*
I took the liberty to remove unnecessary capture groups, escapes and characters.
Although I personally would use something like:
\s*(https?://www.youtube(?:-nocookie)?.com/(?:v|embed)/([a-zA-Z0-9-]+).*)
That puts the entire youtube URL in match group 0 and the video id in match group 1. Also it doesn't make a whole lot of sense to use unicode properties when youtube's URLs don't contain unicode characters.
精彩评论