diff --git a/plugins/chat/assets/javascripts/discourse/components/chat-message-collapser.js b/plugins/chat/assets/javascripts/discourse/components/chat-message-collapser.js index a07a4f9462..3a6100e688 100644 --- a/plugins/chat/assets/javascripts/discourse/components/chat-message-collapser.js +++ b/plugins/chat/assets/javascripts/discourse/components/chat-message-collapser.js @@ -60,7 +60,7 @@ export default class ChatMessageCollapser extends Component { const videoAttributes = getVideoAttributes(e); if (this.siteSettings[`lazy_${videoAttributes.providerName}_enabled`]) { - const link = videoAttributes.url; + const link = escapeExpression(videoAttributes.url); const title = videoAttributes.title; const header = htmlSafe( `` diff --git a/plugins/chat/test/javascripts/acceptance/chat-live-pane-collapse-test.js b/plugins/chat/test/javascripts/acceptance/chat-live-pane-collapse-test.js index 4674ac5072..c59e0ece4d 100644 --- a/plugins/chat/test/javascripts/acceptance/chat-live-pane-collapse-test.js +++ b/plugins/chat/test/javascripts/acceptance/chat-live-pane-collapse-test.js @@ -30,7 +30,7 @@ acceptance("Discourse Chat - Chat live pane collapse", function (needs) { id: 1, message: "https://www.youtube.com/watch?v=aOWkVdU4NH0", cooked: - '
', + '', excerpt: '[Picnic with my cat (shaved ice & lemonade…', created_at: "2021-07-20T08:14:16.950Z", @@ -106,8 +106,9 @@ acceptance("Discourse Chat - Chat live pane collapse", function (needs) { ); }); - skip("can collapse and expand youtube chat", async function (assert) { - const youtubeContainer = ".chat-message-container[data-id='1'] .lazyYT"; + skip("can collapse and expand videos in chat", async function (assert) { + const videoContainer = + ".chat-message-container[data-id='1'] .lazy-video-container"; const expandImage = ".chat-message-container[data-id='1'] .chat-message-collapser-closed"; const collapseImage = @@ -115,19 +116,19 @@ acceptance("Discourse Chat - Chat live pane collapse", function (needs) { await visit("/chat/c/cat/1"); - assert.ok(visible(youtubeContainer)); + assert.ok(visible(videoContainer)); assert.ok(visible(collapseImage), "the open arrow is shown"); assert.notOk(exists(expandImage), "the close arrow is hidden"); await click(collapseImage); - assert.notOk(visible(youtubeContainer)); + assert.notOk(visible(videoContainer)); assert.ok(visible(expandImage), "the close arrow is shown"); assert.notOk(exists(collapseImage), "the open arrow is hidden"); await click(expandImage); - assert.ok(visible(youtubeContainer)); + assert.ok(visible(videoContainer)); assert.ok(visible(collapseImage), "the open arrow is shown again"); assert.notOk(exists(expandImage), "the close arrow is hidden again"); }); diff --git a/plugins/chat/test/javascripts/components/chat-message-collapser-test.js b/plugins/chat/test/javascripts/components/chat-message-collapser-test.js index 56be03b199..0025a99fdb 100644 --- a/plugins/chat/test/javascripts/components/chat-message-collapser-test.js +++ b/plugins/chat/test/javascripts/components/chat-message-collapser-test.js @@ -10,9 +10,9 @@ import { module, test } from "qunit"; const youtubeCooked = "written text
" + - 'more written text
" + - 'and even more
"; const animatedImageCooked = @@ -71,7 +71,13 @@ module( setupRenderingTest(hooks); test("escapes youtube header", async function (assert) { - this.set("cooked", youtubeCooked.replace("ytId1", evilString)); + this.set( + "cooked", + youtubeCooked.replace( + "https://www.youtube.com/watch?v=ytId1", + `https://www.youtube.com/watch?v=${evilString}` + ) + ); await render(hbs`