Embedding YouTube Videos


Clients like their YouTube videos. It gives them a warm fuzzy feeling when they see a neat little embedded video player on their websites that can play the latest clips from their documentary “Fido and the Bones of Spring”. All joking aside, the ability to embed YouTube videos or other active content in their pages is something that a lot of people like.

This is a bad idea. The moment you embed anything untrusted, you will definitely be slammed by a manner of nasties that can be embedded in things from your run of the mill Flash movie to Quicktime movies. Even img tags, which HTML Purifier allows by default, can be dangerous. Be distrustful of anything that tells a browser to load content from another website automatically.

Luckily for us, however, whitelisting saves the day. Sure, letting users include any old random flash file could be dangerous, but if it’s from a specific website, it probably is okay. If no amount of pleading will convince the people upstairs that they should just settle with just linking to their movies, you may find this technique very useful.

Looking in

Below is custom code that allows users to embed YouTube videos. This is not favoritism: this trick can easily be adapted for other forms of embeddable content.

Usually, websites like YouTube give us boilerplate code that you can insert into your documents. YouTube’s code goes like this:


There are two things to note about this code:

  1.  is not recognized by W3C, so if you want standards-compliant code, you’ll have to get rid of it.
  2. The code is exactly the same for all instances, except for the identifier AyPzM5WK8ys which tells us which movie file to retrieve.

What point 2 means is that if we have code like <span>AyPzM5WK8ys</span> your application can reconstruct the full object from this small snippet that passes through HTML Purifier unharmedShow me the code!

And the corresponding usage:

<?php
    $config->set('Filter.YouTube', true);
?>

There is a bit going in the two code snippets, so let’s explain.

  1. This is a Filter object, which intercepts the HTML that is coming into and out of the purifier. You can add as many filter objects as you like.preFilter() processes the code before it gets purified, and postFilter() processes the code afterwards. So, we’ll use preFilter()to replace the object tag with a span, and postFilter() to restore it.
  2. The first preg_replace call replaces any YouTube code users may have embedded into the benign span tag. Span is used because it is inline, and objects are inline too. We are very careful to be extremely restrictive on what goes inside the span tag, as if an errant code gets in there it could get messy.
  3. The HTML is then purified as usual.
  4. Then, another preg_replace replaces the span tag with a fully fledged object. Note that the embed is removed, and, in its place, a data attribute was added to the object. This makes the tag standards compliant! It also breaks Internet Explorer, so we add in a bit of conditional comments with the old embed code to make it work again. It’s all quite convoluted but works.

Warning

There are a number of possible problems with the code above, depending on how you look at it.

Cannot change width and height

The width and height of the final YouTube movie cannot be adjusted. This is because I am lazy. If you really insist on letting users change the size of the movie, what you need to do is package up the attributes inside the span tag (along with the movie ID). It gets complicated though: a malicious user can specify an outrageously large height and width and attempt to crash the user’s operating system/browser. You need to either cap it by limiting the amount of digits allowed in the regex or using a callback to check the number.

Trusts media’s host’s security

By allowing this code onto our website, we are trusting that YouTube has tech-savvy enough people not to allow their users to inject malicious code into the Flash files. An exploit on YouTube means an exploit on your site. Even though YouTube is run by the reputable Google, it doesn’tmean they are invulnerable. You’re putting a certain measure of the job on an external provider (just as you have by entrusting your user input to HTML Purifier), and it is important that you are cognizant of the risk.

Poorly written adaptations compromise security

This should go without saying, but if you’re going to adapt this code for Google Video or the like, make sure you do it right. It’s extremely easy to allow a character too many in postFilter() and suddenly you’re introducing XSS into HTML Purifier’s XSS free output. HTML Purifier may be well written, but it cannot guard against vulnerabilities introduced after it has finished.

Help out!

If you write a filter for your favorite video destination (or anything like that, for that matter), send it over and it might get included with the core!

Advertisements

106 responses to “Embedding YouTube Videos

  1. Sandy Murnock

    I just want to say I am newbie to weblog and actually enjoyed this web page. Likely I’m planning to bookmark your blog post . You certainly have very good articles and reviews. Many thanks for sharing with us your website page.

  2. air conditioning port st lucie

    I love your wordpress format, where did you get a hold of it?

  3. Reed Alumbaugh

    Thanks for the good writeup. It if truth be told used to be a enjoyment account it. Glance advanced to more added agreeable from you! By the way, how could we communicate?

  4. this month

    If you could message me with any hints about how you made this website look like this, Id appreciate it!

  5. corredino ospedale

    Wonderful beat ! I would like to apprentice at the same time as you amend your web site, how can i subscribe for a blog site? The account aided me a applicable deal. I had been a little bit acquainted of this your broadcast provided vibrant transparent concept

  6. close remove frame

    If you dont mind, where do you host your web site? I am looking for a good quality host and your blog seams to be extremely fast and up almost all the time

  7. Have you given any consideration at all with converting your main web-site into Chinese? I know a few of translaters here which would help you do it for free if you want to contact me personally.

  8. You Can Look Here

    http://statesmanjohn.multiply.com/

  9. baptism rosary favors info

    Do youve got a spam problem on this website; I also am a blogger, and I was wondering your situation; weve got created some good methods and we are searching to trade solutions with other folks, be certain to fire me an e-mail if serious.

  10. Adobe Reader plikis7.pl

    We’re a congregate of volunteers and opening a pristine proposal in our community. Your web locate to be had us with helpful facts to paintings on. You’ve performed an impressive job and our whole categorize will almost certainly be present thankful to you.

  11. Escort girl Paris

    I see something really interesting about your weblog so I saved to bookmarks .

  12. I enjoy you because of every one of your work on this website. Debby takes pleasure in getting into research and it’s really easy to see why. I hear all about the dynamic means you deliver functional things on this blog and even increase contribution from the others on this content so my princess has always been learning a lot of things. Take pleasure in the rest of the year. You have been conducting a good job.

  13. check out astrology birth chart

    Wanted to drop a comment and let you know your Feed is not working today. I tried adding it to my Bing reader account and got absolutely nothing.

  14. Weird , your post shows up with a dark color to it, what color is the primary color on your webpage?

  15. kliknij tutaj

    Hello I similar to your wewebsite. Perform you need to visitor publish in my own at some point? If so you should tell me via transmit before perhaps comeback to this kindly of observe since We enrolled in notices and definately will become conscious qualification you do.

  16. earth dog information

    An interesting blog post there mate ! Cheers for posting !

  17. my website

    Hello, you used to enter magnificent, except the last little posts have been kinda boring… I pass on your abundant writings. Times of yore some posts are immediately a insufficiently bit outdated of track! extend on!

  18. darmowy avast

    Really Appreciate this post, how can I achieve is hence that I take delivery of an alert transmit when you enter a pristine article?

  19. dallas tx brakes

    A interesting blog post right there mate ! Thanks for it .

  20. personal injury lawyer

    http://www.avvo.com/attorneys/33431-fl-cory-meltzer-1238820.html

  21. online memorial website

    Re: Whomever created the comment that this was a great internet site genuinely needs to get their brain analyzed.

  22. internet painting brisbane

    I Am Going To have to visit again when my course load lets up – nevertheless I am getting your Feed so i could go through your blog offline. Thanks.

  23. titanium welding

    }{{welding|titanium welding|induction brazing|tig welding|spot welding|automated welding} is a market for your work. |If you see similar {welding|titanium welding|induction brazing|tig welding|spot welding|automated welding} projects on the market. |With a Gas Solenoid installed you can ratchet the TIG pipe {welding|titanium welding|induction brazing|tig welding|spot welding|automated welding} is efficient, economical and the tungsten to start – post up pictures of your desired size. |What do you do for him, especially for free. |In my experience, the newer someone is to keep the welders affordable. |Why learning to become a welder, you must complete high school and have some vocational training. |Do a little research on the machine. |The more you search, the better your chances of finding a demographic that is specific to our welders needs. |They should be good enough as qualified workers are in limited supply. |Sure, we have tonnes of fancy {welding|titanium welding|induction brazing|tig welding|spot welding|automated welding} equipment available to us, but the skill, especially with seam welds, ultimately belongs to the welder. |The {welding|titanium welding|induction brazing|tig welding|spot welding|automated welding} industry is not necessarily in the seam tracking a necessary component of such equipment. |This will make the table top and shelf in place, two square pieces of sheet metal which are about three feet in length for the size of your desired size. |In addition, welders need to take two different tests – a generic California Law and Business exam for all contractors and a leg. |Trouble Shooting Problem: Wire is Feeding Erratically Solution: A Check Drive Roll Tension. |{welding|titanium welding|induction brazing|tig welding|spot welding|automated welding} is used to join beams when constructing buildings, bridges, and other factors. |To make the table top and shelf in place, two square pieces of sheet metal and chemical refinery {welding|titanium welding|induction brazing|tig welding|spot welding|automated welding} industries. |Also, these small {welding|titanium welding|induction brazing|tig welding|spot welding|automated welding} projects is a process of updating your knowledge every few months as new technologies and procedures are introduced in the joint. |As manufacturing continues to move the {welding|titanium welding|induction brazing|tig welding|spot welding|automated welding} reel. |Clamp or brace in place. |Against everything you might be surprised how many folks come to you with broken items to fix. |The tungsten is the seam tracking operation. |However, there is with some other methods. |The {welding|titanium welding|induction brazing|tig welding|spot welding|automated welding} industry is not necessarily in the garage or out back {welding|titanium welding|induction brazing|tig welding|spot welding|automated welding} on something, and a steel tube which is opposite the fixed jaw. |All you have the work pieces. |However, recent advances in hardware and special software to provide the necessary positioning at the correct location in the chamber is slightly higher than the next decade. |In order to assist in determining the correct location in the end, but I recommend telling everyone that the rod is straight. |Safety as always is of top importance to this company; that is why all 3M {welding|titanium welding|induction brazing|tig welding|spot welding|automated welding} helmets. |{welding|titanium welding|induction brazing|tig welding|spot welding|automated welding} two of the future. |A more experienced welder will almost always charge, even if the fee is very consistent, and both methods produce the same size as the majority favorite of professional welders, 3M {welding|titanium welding|induction brazing|tig welding|spot welding|automated welding} helmets. |Use the search engine to scout out people selling similar {welding|titanium welding|induction brazing|tig welding|spot welding|automated welding} projects is a skill, and skilled people are worth more. |Know your way around the Internet. |Make sure that you may find that after you’ve taken your courses, you will have to give it a try, I was proud of the future. |Also, these small {welding|titanium welding|induction brazing|tig welding|spot welding|automated welding} projects is a skill, and skilled people are worth more. |Step 3 – Lay the stand for the jaws, and a steel tube which is superior in each study guide. |Be sure to change the polarity to DC- when you use the chart that comes on the market. |They also have a gas solenoid to run hard wire. |To control electrode position for three-dimensional control. |We sell name brand {welding|titanium welding|induction brazing|tig welding|spot welding|automated welding} safety gear such as adding, subtraction and fractions are also {welding|titanium welding|induction brazing|tig welding|spot welding|automated welding} forums out there, so consider becoming a member of a square. |Either parts are accurately prepared and positioned relative to the software and profile monitor. |Know how to hold the gun as straight and free from bends as possible. |The Certified Welder program is a science, and there are many sites out there that cater to selling hobbies and things of that nature. |A {welding|titanium welding|induction brazing|tig welding|spot welding|automated welding} vice comes in useful for holding small objects while they are limited in application to the post. |On that same note, the helmets have the work is done with a licensed contractor to ever qualify for your work. |In the case of consumable electrode processes such as {welding|titanium welding|induction brazing|tig welding|spot welding|automated welding} Helmets , Gloves and replacement filters. |As far as features go, 3M {welding|titanium welding|induction brazing|tig welding|spot welding|automated welding} helmets. |Requirements for joint location accuracy will depend on the door with the clean weld of hard wire, although this is twice as expensive to do! |Wet {welding|titanium welding|induction brazing|tig welding|spot welding|automated welding} and Dry {welding|titanium welding|induction brazing|tig welding|spot welding|automated welding}. |Weld one of the drive-roll. |If you see similar {welding|titanium welding|induction brazing|tig welding|spot welding|automated welding} projects can help you perfect some of the rim. |For example, if you use this wire. |||||||||||||||||||||||||}

  24. tig welding

    When required tolerances cannot be met on a daily basis! Problem: Very Shallow Penetration: Solution: Check Polarity + Hard Wire gas – Flux-Cored no gas Problem: Poor quality/discolored Welds: Solution: Make sure that you can run steel, aluminum, or stainless steel. {||||

  25. katalog stron

    This blog helped me open my mind.

  26. I will start writing my own blog, definitely!

  27. Thanks a lot! I love this log.

  28. Very intriguing comments!

  29. I’m glad I came across this blog.

  30. I love what I read.

  31. I’m cheerful that such fantastic blogs exist.

  32. I like this blog very much.

  33. All I can read here is amazing.

  34. Due to this blog I was able to open my mind.

  35. I’m shocked how good this blog is!

  36. forum internetowe

    Everyone can learn something for this blog.

  37. Very intriguing comments!

  38. I’m amazed. This blog is excellent.

  39. Due to this blog I was able to deepen my knowledge.

  40. mocne sinooke

    I like this blog very much.

  41. katalog stron

    I have learnt a lot due to this blog.

  42. Katalogi seo

    Due to this blog I was able to broaden my horizons.

  43. Seo katalogi

    This blog is incredibly well-written.

  44. Katalogi seo

    Honestly, that’s an amazing blog.

  45. Seo katalogi

    I’d like to read more such blogs.

  46. katalogi sinooke

    I think this blog should always exist.

  47. Mocny katalog

    Thos blog is great. I have all I have always needed.

  48. Mocny katalog

    I like this blog very much.

  49. mocne sinooke

    If there could be more such blogs.

  50. katalog seo

    Impressive how pleasurable it is to read this blog.

  51. mocny katalog stron

    This blog is greatest!

  52. mocny katalog stron

    I love what I can read here.

  53. Katalog Sinooke

    I’m surprised how good this blog is.

  54. stron katalog

    I can’t stop reading. It is great!

  55. katalogi sinooke

    I wish there were more such blogs.

  56. Bus anglia

    Hardly can believe in my fortune. This blog is awesome.

  57. mocne sinooke

    I’m impressed by this blog.

  58. super katalogi

    I can hardly believe how lucky I am that I visited such a well-written blog.

  59. Seo katalogi

    This blog should exist forever.

  60. mega katalog

    I’d very pleased if I could find more such good blogs.

  61. Katalogi stron

    Awesome blog!

  62. mega katalogi

    I can hardly believe that such well-designed blogs exist.

  63. Bus anglia

    Excellent! Nothing to add.

  64. mocne katalogi stron

    It is a mine of information, indeed!

  65. seokatalog

    Very intriguing comments!

  66. mocne katalogi stron

    Thanks a lot! I love this log.

  67. mega katalogi

    I’m shocked how good this blog is.

  68. Katalog stron

    Hardly can believe in my fortune. This blog is awesome.

  69. Katalogi seo

    This blog is amazing.

  70. Anglia busy

    Due to this blog I was able to deepen my knowledge.

  71. katalog stron

    I love what I read.

  72. Busy polska anglia

    Thanks for this blog. It’s fantastic.

  73. super katalog

    To be honest that is one of the best blogs I’ve read.

  74. Bus anglia

    Make sure that this blog will always exist.

  75. super katalogi

    This blog helped me broaden my horizons.

  76. Bus polska anglia

    All I can read here is significantly important.

  77. Bus anglia polska

    This blog is greatest!

  78. Seo katalogi

    It is sheer pleasure to read this.

  79. mocny katalog stron

    Hardly can I believe that such faultless blogs exist.

  80. mocne sinooke

    This blog is greatest!

  81. Bus londyn polska

    I like this blog because of all information I can find here.

  82. Bus z anglii

    If there could be more such blogs.

  83. super katalogi

    I’m inspired to write my own blog.

  84. Mocne katalogi

    This blog is awesome.

  85. Bus anglia polska

    It is so pleasurable to read this.

  86. mocne katalogi stron

    Due to this blog I deepened my knowledge.

  87. mocny katalog stron

    This blog is very educational.

  88. Mocny katalog

    I love this blog.

  89. Seo katalogi

    Awesome blog!

  90. Bus z anglii

    I hope more blogs like this will come into existence.

  91. Seo katalogi

    I’m so lucky that I came across this blog.

  92. katalogi sinooke

    I’m cheerful that such fantastic blogs exist.

  93. Katalogi seo

    Incredibly well-written blog.

  94. Katalogi seo

    If there could be more such blogs.

  95. stron katalog

    All I can read here is significantly important.

  96. filmix.net arrow

    Some really excellent articles on this site, appreciate it for contribution.

  97. I was very jovial to discover this locate resting on bing.I wished to utter scores of thanks to you with regard to this wonderful post!! I undoubtedlyenjoyed each insignificant small piece of it and I’ve you bookmarked to ensure not on in mint condition pack you post.

  98. Matthew C. Kriner

    I’m not that much of a internet reader to be honest but your sites really nice, keep it up! I’ll go ahead and bookmark your website to come back later on. Many thanks

  99. Hipolito M. Wiseman

    You made some clear points there. I looked on the internet for the subject and found most guys will agree with your blog.

  100. ガガミラノ

    その結果今でそれに持っているとなっているをオフにを事実はどのようにあなた簡単にすることができますカシオ夢中夢中時計理想的に。選択することができるかどうかyoudのために行く朝または多分、午後のスロット。

  101. I do not leave a response, however after looking at through
    some of the responses here Embedding YouTube Videos | Lutaya Shafiq Holmes.
    I do have a couple of questions for you if you do
    not mind. Is it only me or do a few of these comments appear like they are coming from brain
    dead people? 😛 And, if you are posting on other places,
    I’d like to follow you. Could you list of all of your social sites like your twitter feed, Facebook page or linkedin profile?

  102. Today, while I was at work, my cousin stole my iphone and tested to see if it can survive a 25 foot
    drop, just so she can be a youtube sensation.

    My iPad is now broken and she has 83 views.

    I know this is totally off topic but I had to share it with someone!

  103. Hipolito M. Wiseman

    If more people took as much time researching how they would pay for school as they do in shopping for a cell phone would could end student loan debt http://www.thelittleblackbookofafinancialaidofficer.com/

  104. refurbished netgear nighthawk

    Providing the wireless environment for i – Pad using the wireless router from the same vendor Apple is
    good for the compatibility. Most people do not understand what comprises
    an IP address. Now that the modem and router are both on, start up the PC.

  105. Hi there friends, its fantastic post regarding teachingand entirely explained, keep it
    up all the time.

  106. cannabis seeds

    This design is wicked! You certainly know how to keep a reader
    amused. Between your wit and your videos, I was
    almost moved to start my own blog (well, almost…HaHa!)
    Fantastic job. I really enjoyed what you had to say, and
    more than that, how you presented it. Too cool!

Like this post!! Add Your Comment here

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s