urosm
/
ikiwiki
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Note the use of <embed /> on YouTube.

master
http://oneingray.myopenid.com/ 2010-03-12 22:12:41 +00:00 committed by Joey Hess
parent 29ca20b87c
commit c26b6c3be8
1 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
doc/todo/finer_control_over___60__object___47____62__s.mdwn
View File

@ -57,10 +57,23 @@ For Ikiwiki, it may be nice to be able to restrict [URI's][URI] (as required by
>> `usemap`) should make `object` almost as harmless as, say, `img`. >> `usemap`) should make `object` almost as harmless as, say, `img`.
>>> But with local data, one could not embed youtube videos, which surely >>> But with local data, one could not embed youtube videos, which surely
>>> is the most obvious use case? Note that youtube embedding uses an >>> is the most obvious use case?
>>>> Allowing a &ldquo;remote&rdquo; object to render on one's page is a
security issue by itself.
Though, of course, having an explicit whitelist of URI's may make
this issue more tolerable.
&mdash;&nbsp;[[Ivan_Shmakov]], 2010-03-12Z.
>>> Note that youtube embedding uses an
>>> object element with no classid. The swf file is provided via an >>> object element with no classid. The swf file is provided via an
>>> enclosed param element. --[[Joey]] >>> enclosed param element. --[[Joey]]
>>>> I've just checked a random video on YouTube and I see that the
`.swf` file is provided via an enclosed `embed` element. Whether
to allow those or not is a different issue.
&mdash;&nbsp;[[Ivan_Shmakov]], 2010-03-12Z.
>> (Though it certainly won't solve the [[SVG_problem|/todo/SVG]] being >> (Though it certainly won't solve the [[SVG_problem|/todo/SVG]] being
>> restricted in such a way.) >> restricted in such a way.)