From 3a4bd80d8ade43b8b3909b17cdd849c8d03dbc66 Mon Sep 17 00:00:00 2001
From: Rafael dos Santos Silva <xfalcox@gmail.com>
Date: Mon, 21 Dec 2020 14:55:00 -0300
Subject: [PATCH] FIX: Autoplay videos must always be muted (#11533)

This automatically adds the muted attribute if it's missing in a video
tag.

Co-authored-by: David Taylor <david@taylorhq.com>
---
 .../tests/unit/lib/sanitizer-test.js          | 32 +++++++++++++++++++
 .../pretty-text/addon/allow-lister.js         |  2 +-
 .../pretty-text/addon/sanitizer.js            |  6 ++++
 3 files changed, 39 insertions(+), 1 deletion(-)

diff --git a/app/assets/javascripts/discourse/tests/unit/lib/sanitizer-test.js b/app/assets/javascripts/discourse/tests/unit/lib/sanitizer-test.js
index cdc6a33a757..3025ac81ae7 100644
--- a/app/assets/javascripts/discourse/tests/unit/lib/sanitizer-test.js
+++ b/app/assets/javascripts/discourse/tests/unit/lib/sanitizer-test.js
@@ -168,6 +168,38 @@ module("Unit | Utility | sanitizer", function () {
     );
   });
 
+  test("autoplay videos must be muted", function (assert) {
+    let pt = new PrettyText(buildOptions({ siteSettings: {} }));
+    assert.ok(
+      pt
+        .sanitize(
+          `<p>Hey</p><video autoplay src="http://example.com/music.mp4"/>`
+        )
+        .match(/muted/)
+    );
+    assert.ok(
+      pt
+        .sanitize(
+          `<p>Hey</p><video autoplay><source src="http://example.com/music.mp4" type="audio/mpeg"></video>`
+        )
+        .match(/muted/)
+    );
+    assert.ok(
+      pt
+        .sanitize(
+          `<p>Hey</p><video autoplay muted><source src="http://example.com/music.mp4" type="audio/mpeg"></video>`
+        )
+        .match(/muted/)
+    );
+    assert.notOk(
+      pt
+        .sanitize(
+          `<p>Hey</p><video><source src="http://example.com/music.mp4" type="audio/mpeg"></video>`
+        )
+        .match(/muted/)
+    );
+  });
+
   test("poorly formed ids on headings", function (assert) {
     let pt = new PrettyText(buildOptions({ siteSettings: {} }));
     assert.equal(
diff --git a/app/assets/javascripts/pretty-text/addon/allow-lister.js b/app/assets/javascripts/pretty-text/addon/allow-lister.js
index 1844702b6ec..930edc704a3 100644
--- a/app/assets/javascripts/pretty-text/addon/allow-lister.js
+++ b/app/assets/javascripts/pretty-text/addon/allow-lister.js
@@ -225,7 +225,7 @@ export const DEFAULT_LIST = [
   "track[srclang]",
   "ul",
   "video",
-  "video[autoplay]",
+  // video[autoplay] handled by sanitizer.js
   "video[controls]",
   "video[controlslist]",
   "video[crossorigin]",
diff --git a/app/assets/javascripts/pretty-text/addon/sanitizer.js b/app/assets/javascripts/pretty-text/addon/sanitizer.js
index 23eea075e14..f29c37b80f5 100644
--- a/app/assets/javascripts/pretty-text/addon/sanitizer.js
+++ b/app/assets/javascripts/pretty-text/addon/sanitizer.js
@@ -126,6 +126,12 @@ export function sanitize(text, allowLister) {
           return "-STRIP-";
         }
 
+        if (tag === "video" && name === "autoplay") {
+          // This might give us duplicate 'muted' atttributes
+          // but they will be deduped by later processing
+          return "autoplay muted";
+        }
+
         // Heading ids must begin with `heading--`
         if (
           ["h1", "h2", "h3", "h4", "h5", "h6"].indexOf(tag) !== -1 &&