discourse/lib/onebox/engine/trello_onebox.rb
Blake Erickson 17116c440b
SECURITY: Restrict allowed URL patterns
Restrict allowed URL patterns for oneboxes.
2025-02-04 13:32:34 -03:00

39 lines
874 B
Ruby

# frozen_string_literal: true
module Onebox
module Engine
class TrelloOnebox
include Engine
include StandardEmbed
matches_domain("trello.com")
requires_iframe_origins "https://trello.com"
always_https
def self.matches_path(path)
path.match?(%r{^/[bc]/\w*})
end
def to_html
src = "https://trello.com/#{match[:type]}/#{match[:key]}.html"
height = match[:type] == "b" ? 400 : 200
<<-HTML
<iframe src="#{src}" width="100%" height="#{height}" frameborder="0" style="border:0"></iframe>
HTML
end
def placeholder_html
::Onebox::Helpers.generic_placeholder_html
end
private
def match
return @match if defined?(@match)
@match = @url.match(%{trello\.com/(?<type>[^/]+)/(?<key>[^/]+)/?\W*})
end
end
end
end