Sanitize html returned by oEmbed providers to protect laconica from XSS attacks

1 files changed, 6 insertions, 1 deletions

diff --git a/lib/attachmentlist.php b/lib/attachmentlist.php
index f6a1b59d0..41d03f8e2 100644
--- a/lib/attachmentlist.php
+++ b/lib/attachmentlist.php
@@ -340,7 +340,12 @@ class Attachment extends AttachmentListItem
             case 'video':
             case 'link':
                 if (!empty($this->oembed->html)) {
-                    $this->out->raw($this->oembed->html);
+                    require_once INSTALLDIR.'/extlib/htmLawed/htmLawed.php';
+                    $config = array(
+                        'safe'=>1,
+                        'elements'=>'*+object+embed');
+                    $this->out->raw(htmLawed($this->oembed->html,$config));
+                    //$this->out->raw($this->oembed->html);
                 }
                 break;