XSS when embeding youtube video

[agabhane]

When we try to embed youtube video using below iframe syntax, javascript code gets executed.

<iframe width="560" height="315" src="https://www.youtube.com/embed/ADS742xsoTw" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen onmouseover=alert(document.domain)></iframe>

Steps to reproduce

1. Click on youtube toolbar button
2. Paste <iframe width="560" height="315" src="https://www.youtube.com/embed/ADS742xsoTw" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen onmouseover=alert(document.domain)></iframe> in embed code box
3. Click ok
4. Observe alert

Actual result
Alert is shown with domain name

Expected result
Pasted code should be sanitized and js should not be exeucted to display alert.

[agabhane]

Hi @fonini ,

Any ETA on fix for this issue?

[fonini]

@agabhane At the moment, I do not have the time to work on this issue. Can you open a PR?

[sushruts]

Hi @fonini , is there any ETA for this fix ?

[fonini]

Hi @sushruts, unfortunately, I have no time to look into this right now.

[sushrutsawarkar]

Hi @fonini , I see there are no updates around this plugin. Do you have a any ETA for this issue?