diff --git a/plugins/chat/assets/javascripts/discourse/components/chat-message-collapser.js b/plugins/chat/assets/javascripts/discourse/components/chat-message-collapser.js index a07a4f9462..3a6100e688 100644 --- a/plugins/chat/assets/javascripts/discourse/components/chat-message-collapser.js +++ b/plugins/chat/assets/javascripts/discourse/components/chat-message-collapser.js @@ -60,7 +60,7 @@ export default class ChatMessageCollapser extends Component { const videoAttributes = getVideoAttributes(e); if (this.siteSettings[`lazy_${videoAttributes.providerName}_enabled`]) { - const link = videoAttributes.url; + const link = escapeExpression(videoAttributes.url); const title = videoAttributes.title; const header = htmlSafe( `${title}` diff --git a/plugins/chat/test/javascripts/acceptance/chat-live-pane-collapse-test.js b/plugins/chat/test/javascripts/acceptance/chat-live-pane-collapse-test.js index 4674ac5072..c59e0ece4d 100644 --- a/plugins/chat/test/javascripts/acceptance/chat-live-pane-collapse-test.js +++ b/plugins/chat/test/javascripts/acceptance/chat-live-pane-collapse-test.js @@ -30,7 +30,7 @@ acceptance("Discourse Chat - Chat live pane collapse", function (needs) { id: 1, message: "https://www.youtube.com/watch?v=aOWkVdU4NH0", cooked: - '
', + '
', excerpt: '[Picnic with my cat (shaved ice & lemonade…', created_at: "2021-07-20T08:14:16.950Z", @@ -106,8 +106,9 @@ acceptance("Discourse Chat - Chat live pane collapse", function (needs) { ); }); - skip("can collapse and expand youtube chat", async function (assert) { - const youtubeContainer = ".chat-message-container[data-id='1'] .lazyYT"; + skip("can collapse and expand videos in chat", async function (assert) { + const videoContainer = + ".chat-message-container[data-id='1'] .lazy-video-container"; const expandImage = ".chat-message-container[data-id='1'] .chat-message-collapser-closed"; const collapseImage = @@ -115,19 +116,19 @@ acceptance("Discourse Chat - Chat live pane collapse", function (needs) { await visit("/chat/c/cat/1"); - assert.ok(visible(youtubeContainer)); + assert.ok(visible(videoContainer)); assert.ok(visible(collapseImage), "the open arrow is shown"); assert.notOk(exists(expandImage), "the close arrow is hidden"); await click(collapseImage); - assert.notOk(visible(youtubeContainer)); + assert.notOk(visible(videoContainer)); assert.ok(visible(expandImage), "the close arrow is shown"); assert.notOk(exists(collapseImage), "the open arrow is hidden"); await click(expandImage); - assert.ok(visible(youtubeContainer)); + assert.ok(visible(videoContainer)); assert.ok(visible(collapseImage), "the open arrow is shown again"); assert.notOk(exists(expandImage), "the close arrow is hidden again"); }); diff --git a/plugins/chat/test/javascripts/components/chat-message-collapser-test.js b/plugins/chat/test/javascripts/components/chat-message-collapser-test.js index 56be03b199..0025a99fdb 100644 --- a/plugins/chat/test/javascripts/components/chat-message-collapser-test.js +++ b/plugins/chat/test/javascripts/components/chat-message-collapser-test.js @@ -10,9 +10,9 @@ import { module, test } from "qunit"; const youtubeCooked = "

written text

" + - '
Vid 1
' + + '
Vid 1
' + "

more written text

" + - '
Vid 2
' + + '
Vid 2
' + "

and even more

"; const animatedImageCooked = @@ -71,7 +71,13 @@ module( setupRenderingTest(hooks); test("escapes youtube header", async function (assert) { - this.set("cooked", youtubeCooked.replace("ytId1", evilString)); + this.set( + "cooked", + youtubeCooked.replace( + "https://www.youtube.com/watch?v=ytId1", + `https://www.youtube.com/watch?v=${evilString}` + ) + ); await render(hbs``); assert.true( @@ -124,7 +130,7 @@ module( await render(hbs``); - const youtubeDivs = queryAll(".onebox"); + const youtubeDivs = queryAll(".youtube-onebox"); assert.strictEqual( youtubeDivs.length, @@ -138,11 +144,11 @@ module( ); assert.false( - visible(".onebox[data-youtube-id='ytId1']"), + visible(".youtube-onebox[data-video-id='ytId1']"), "first youtube preview hidden" ); assert.true( - visible(".onebox[data-youtube-id='ytId2']"), + visible(".youtube-onebox[data-video-id='ytId2']"), "second youtube preview still visible" ); @@ -160,11 +166,11 @@ module( ); assert.true( - visible(".onebox[data-youtube-id='ytId1']"), + visible(".youtube-onebox[data-video-id='ytId1']"), "first youtube preview still visible" ); assert.false( - visible(".onebox[data-youtube-id='ytId2']"), + visible(".youtube-onebox[data-video-id='ytId2']"), "second youtube preview hidden" ); diff --git a/plugins/chat/test/javascripts/components/chat-message-text-test.js b/plugins/chat/test/javascripts/components/chat-message-text-test.js index f0ba6fcd14..b5f05f80bc 100644 --- a/plugins/chat/test/javascripts/components/chat-message-text-test.js +++ b/plugins/chat/test/javascripts/components/chat-message-text-test.js @@ -22,7 +22,7 @@ module("Discourse Chat | Component | chat-message-text", function (hooks) { test("shows collapsed", async function (assert) { this.set( "cooked", - '
' + '
' ); await render( @@ -51,7 +51,10 @@ module("Discourse Chat | Component | chat-message-text", function (hooks) { }); test("shows edits - collapsible message", async function (assert) { - this.set("cooked", '
'); + this.set( + "cooked", + '
' + ); await render( hbs``