search

anvilproject / anvil-portal

The NHGRI Analysis Visualization and Informatics Lab-space (AnVIL) website
https://anvilproject.org/
MIT License
3 stars 20 forks source link

Review YouTube video implementation for insecure iframe #3339

Closed NoopDog closed 3 weeks ago

NoopDog commented 3 weeks ago

We will need something like:

<iframe
  frameborder="0"
  allowfullscreen
  allow="encrypted-media; picture-in-picture"
  referrerpolicy="strict-origin-when-cross-origin"
  title="Sharing on AnVIL"
  width="100%"
  height="100%"
  src="https://www.youtube.com/embed/VKDBT4lTDv8?autoplay=0&mute=0&controls=0&origin=https%3A%2F%2Fanvilproject.org&playsinline=1&showinfo=0&rel=0&iv_load_policy=3&modestbranding=1&enablejsapi=1"
  id="widget2"
  sandbox="allow-same-origin allow-scripts allow-presentation"
></iframe>

We can't completely sandbox it but we can add sandbox and then start loosening it to see when it starts working.