Skip to content

Commit 094e308

Browse files
author
arnayv-47
committed
sanitize signsrc for ableplayer
1 parent 1db7322 commit 094e308

2 files changed

Lines changed: 174 additions & 143 deletions

File tree

‎testfiles/assets/ableplayer/build/ableplayer.dist.js‎

Lines changed: 82 additions & 71 deletions
Original file line numberDiff line numberDiff line change
@@ -13302,102 +13302,113 @@ if (thisObj.useTtml && (trackSrc.endsWith('.xml') || trackText.startsWith('<?xml
1330213302
})(jQuery);
1330313303

1330413304
(function ($) {
13305-
AblePlayer.prototype.initSignLanguage = function() {
1330613305

13307-
// Sign language is only currently supported in HTML5 player, not YouTube or Vimeo
13308-
if (this.player === 'html5') {
13309-
// check to see if there's a sign language video accompanying this video
13310-
// check only the first source
13311-
// If sign language is provided, it must be provided for all sources
13312-
this.signFile = this.$sources.first().attr('data-sign-src');
13313-
if (this.signFile) {
13314-
if (this.isIOS()) {
13315-
// IOS does not allow multiple videos to play simultaneously
13316-
// Therefore, sign language as rendered by Able Player unfortunately won't work
13306+
AblePlayer.prototype.initSignLanguage = function () {
13307+
13308+
// Sign language is only currently supported in HTML5 player, not YouTube or Vimeo
13309+
if (this.player === 'html5') {
13310+
// check to see if there's a sign language video accompanying this video
13311+
// check only the first source
13312+
// If sign language is provided, it must be provided for all sources
13313+
this.signFile = this.$sources.first().attr('data-sign-src');
13314+
if (this.signFile) {
13315+
if (this.isIOS()) {
13316+
// IOS does not allow multiple videos to play simultaneously
13317+
// Therefore, sign language as rendered by Able Player unfortunately won't work
1331713318
this.hasSignLanguage = false;
1331813319
if (this.debug) {
13319-
1332013320
}
1332113321
}
1332213322
else {
13323-
if (this.debug) {
13324-
13323+
if (this.debug) {
1332513324
}
1332613325
this.hasSignLanguage = true;
1332713326
this.injectSignPlayerCode();
1332813327
}
13329-
}
13330-
else {
13331-
this.hasSignLanguage = false;
13332-
}
13333-
}
13334-
else {
13335-
this.hasSignLanguage = false;
13336-
}
13337-
};
13328+
}
13329+
else {
13330+
this.hasSignLanguage = false;
13331+
}
13332+
}
13333+
else {
13334+
this.hasSignLanguage = false;
13335+
}
13336+
};
1333813337

13339-
AblePlayer.prototype.injectSignPlayerCode = function() {
13338+
AblePlayer.prototype.injectSignPlayerCode = function () {
1334013339

13341-
// create and inject surrounding HTML structure
13340+
// Helper to sanitize and validate sign language video URLs
13341+
function sanitizeURL(url) {
13342+
try {
13343+
return new URL(url, window.location.href).href;
13344+
} catch (e) {
13345+
return null; // Invalid URL
13346+
}
13347+
}
1334213348

13343-
var thisObj, signVideoId, signVideoWidth, i, signSrc, srcType, $signSource;
13349+
var thisObj, signVideoId, signVideoWidth, i, signSrc, srcType, $signSource;
1334413350

13345-
thisObj = this;
13351+
thisObj = this;
1334613352

13347-
signVideoWidth = this.getDefaultWidth('sign');
13353+
signVideoWidth = this.getDefaultWidth('sign');
1334813354

13349-
signVideoId = this.mediaId + '-sign';
13350-
this.$signVideo = $('<video>',{
13351-
'id' : signVideoId,
13352-
'tabindex' : '-1'
13353-
});
13354-
this.signVideo = this.$signVideo[0];
13355-
// for each original <source>, add a <source> to the sign <video>
13356-
for (i=0; i < this.$sources.length; i++) {
13357-
signSrc = this.$sources[i].getAttribute('data-sign-src');
13358-
srcType = this.$sources[i].getAttribute('type');
13359-
if (signSrc) {
13360-
$signSource = $('<source>',{
13361-
'src' : signSrc,
13362-
'type' : srcType
13363-
});
13364-
this.$signVideo.append($signSource);
13365-
}
13366-
else {
13367-
// source is missing a sign language version
13368-
// can't include sign language
13369-
this.hasSignLanguage = false;
13370-
break;
13371-
}
13372-
}
13355+
signVideoId = this.mediaId + '-sign';
13356+
this.$signVideo = $('<video>', {
13357+
'id': signVideoId,
13358+
'tabindex': '-1'
13359+
});
13360+
this.signVideo = this.$signVideo[0];
1337313361

13374-
this.$signWindow = $('<div>',{
13375-
'class' : 'able-sign-window',
13376-
'role': 'dialog',
13362+
// for each original <source>, add a <source> to the sign <video>
13363+
for (i = 0; i < this.$sources.length; i++) {
13364+
signSrc = this.$sources[i].getAttribute('data-sign-src');
13365+
srcType = this.$sources[i].getAttribute('type');
13366+
13367+
signSrc = sanitizeURL(signSrc); // Sanitize the URL
13368+
13369+
if (signSrc) {
13370+
$signSource = $('<source>', {
13371+
'src': signSrc,
13372+
'type': srcType
13373+
});
13374+
this.$signVideo.append($signSource);
13375+
}
13376+
else {
13377+
// source is missing a sign language version
13378+
// can't include sign language
13379+
this.hasSignLanguage = false;
13380+
break;
13381+
}
13382+
}
13383+
13384+
this.$signWindow = $('<div>', {
13385+
'class': 'able-sign-window',
13386+
'role': 'dialog',
1337713387
'aria-label': this.tt.sign
13378-
});
13379-
this.$signToolbar = $('<div>',{
13380-
'class': 'able-window-toolbar able-' + this.toolbarIconColor + '-controls'
13381-
});
13388+
});
13389+
this.$signToolbar = $('<div>', {
13390+
'class': 'able-window-toolbar able-' + this.toolbarIconColor + '-controls'
13391+
});
1338213392

13383-
this.$signWindow.append(this.$signToolbar, this.$signVideo);
13393+
this.$signWindow.append(this.$signToolbar, this.$signVideo);
1338413394

13385-
this.$ableWrapper.append(this.$signWindow);
13395+
this.$ableWrapper.append(this.$signWindow);
1338613396

13387-
// make it draggable
13388-
this.initDragDrop('sign');
13397+
// make it draggable
13398+
this.initDragDrop('sign');
1338913399

13390-
if (this.prefSign === 1) {
13391-
// sign window is on. Go ahead and position it and show it
13392-
this.positionDraggableWindow('sign',this.getDefaultWidth('sign'));
13393-
}
13394-
else {
13395-
this.$signWindow.hide();
13396-
}
13397-
};
13400+
if (this.prefSign === 1) {
13401+
// sign window is on. Go ahead and position it and show it
13402+
this.positionDraggableWindow('sign', this.getDefaultWidth('sign'));
13403+
}
13404+
else {
13405+
this.$signWindow.hide();
13406+
}
13407+
};
1339813408

1339913409
})(jQuery);
1340013410

13411+
1340113412
(function ($) {
1340213413
// Look up ISO 639-1 language codes to be used as subtitle labels
1340313414
// In some instances "name" has been trunctation for readability

‎testfiles/assets/ableplayer/build/ableplayer.js‎

Lines changed: 92 additions & 72 deletions
Original file line numberDiff line numberDiff line change
@@ -13307,99 +13307,119 @@ console.log('You pushed ESC');
1330713307
})(jQuery);
1330813308

1330913309
(function ($) {
13310-
AblePlayer.prototype.initSignLanguage = function() {
1331113310

13312-
// Sign language is only currently supported in HTML5 player, not YouTube or Vimeo
13313-
if (this.player === 'html5') {
13314-
// check to see if there's a sign language video accompanying this video
13315-
// check only the first source
13316-
// If sign language is provided, it must be provided for all sources
13317-
this.signFile = this.$sources.first().attr('data-sign-src');
13318-
if (this.signFile) {
13319-
if (this.isIOS()) {
13320-
// IOS does not allow multiple videos to play simultaneously
13321-
// Therefore, sign language as rendered by Able Player unfortunately won't work
13311+
AblePlayer.prototype.initSignLanguage = function () {
13312+
13313+
// Helper to sanitize and validate sign language video URLs
13314+
function sanitizeURL(url) {
13315+
try {
13316+
return new URL(url, window.location.href).href;
13317+
} catch (e) {
13318+
return null;
13319+
}
13320+
}
13321+
13322+
// Sign language is only currently supported in HTML5 player, not YouTube or Vimeo
13323+
if (this.player === 'html5') {
13324+
// check to see if there's a sign language video accompanying this video
13325+
// check only the first source
13326+
// If sign language is provided, it must be provided for all sources
13327+
let rawSignFile = this.$sources.first().attr('data-sign-src');
13328+
this.signFile = sanitizeURL(rawSignFile);
13329+
13330+
if (this.signFile) {
13331+
if (this.isIOS()) {
13332+
// IOS does not allow multiple videos to play simultaneously
1332213333
this.hasSignLanguage = false;
1332313334
if (this.debug) {
1332413335
console.log('Sign language has been disabled due to IOS restrictions');
1332513336
}
13326-
}
13327-
else {
13328-
if (this.debug) {
13329-
console.log('This video has an accompanying sign language video: ' + this.signFile);
13337+
} else {
13338+
if (this.debug) {
13339+
console.log('This video has an accompanying sign language video: ' + this.signFile);
1333013340
}
1333113341
this.hasSignLanguage = true;
1333213342
this.injectSignPlayerCode();
1333313343
}
13334-
}
13335-
else {
13336-
this.hasSignLanguage = false;
13337-
}
13338-
}
13339-
else {
13340-
this.hasSignLanguage = false;
13341-
}
13342-
};
13344+
}
13345+
else {
13346+
this.hasSignLanguage = false;
13347+
}
13348+
}
13349+
else {
13350+
this.hasSignLanguage = false;
13351+
}
13352+
};
1334313353

13344-
AblePlayer.prototype.injectSignPlayerCode = function() {
13354+
AblePlayer.prototype.injectSignPlayerCode = function () {
1334513355

13346-
// create and inject surrounding HTML structure
13356+
// Helper to sanitize and validate URLs
13357+
function sanitizeURL(url) {
13358+
try {
13359+
return new URL(url, window.location.href).href;
13360+
} catch (e) {
13361+
return null;
13362+
}
13363+
}
1334713364

13348-
var thisObj, signVideoId, signVideoWidth, i, signSrc, srcType, $signSource;
13365+
var thisObj, signVideoId, signVideoWidth, i, signSrc, srcType, $signSource;
1334913366

13350-
thisObj = this;
13367+
thisObj = this;
1335113368

13352-
signVideoWidth = this.getDefaultWidth('sign');
13369+
signVideoWidth = this.getDefaultWidth('sign');
1335313370

13354-
signVideoId = this.mediaId + '-sign';
13355-
this.$signVideo = $('<video>',{
13356-
'id' : signVideoId,
13357-
'tabindex' : '-1'
13358-
});
13359-
this.signVideo = this.$signVideo[0];
13360-
// for each original <source>, add a <source> to the sign <video>
13361-
for (i=0; i < this.$sources.length; i++) {
13362-
signSrc = this.$sources[i].getAttribute('data-sign-src');
13363-
srcType = this.$sources[i].getAttribute('type');
13364-
if (signSrc) {
13365-
$signSource = $('<source>',{
13366-
'src' : signSrc,
13367-
'type' : srcType
13368-
});
13369-
this.$signVideo.append($signSource);
13370-
}
13371-
else {
13372-
// source is missing a sign language version
13373-
// can't include sign language
13374-
this.hasSignLanguage = false;
13375-
break;
13376-
}
13377-
}
13371+
signVideoId = this.mediaId + '-sign';
13372+
this.$signVideo = $('<video>', {
13373+
'id': signVideoId,
13374+
'tabindex': '-1'
13375+
});
13376+
this.signVideo = this.$signVideo[0];
1337813377

13379-
this.$signWindow = $('<div>',{
13380-
'class' : 'able-sign-window',
13381-
'role': 'dialog',
13378+
// for each original <source>, add a <source> to the sign <video>
13379+
for (i = 0; i < this.$sources.length; i++) {
13380+
signSrc = this.$sources[i].getAttribute('data-sign-src');
13381+
srcType = this.$sources[i].getAttribute('type');
13382+
13383+
signSrc = sanitizeURL(signSrc); // ✅ Fix is here
13384+
13385+
if (signSrc) {
13386+
$signSource = $('<source>', {
13387+
'src': signSrc,
13388+
'type': srcType
13389+
});
13390+
this.$signVideo.append($signSource);
13391+
}
13392+
else {
13393+
// source is missing a sign language version
13394+
this.hasSignLanguage = false;
13395+
break;
13396+
}
13397+
}
13398+
13399+
this.$signWindow = $('<div>', {
13400+
'class': 'able-sign-window',
13401+
'role': 'dialog',
1338213402
'aria-label': this.tt.sign
13383-
});
13384-
this.$signToolbar = $('<div>',{
13385-
'class': 'able-window-toolbar able-' + this.toolbarIconColor + '-controls'
13386-
});
13403+
});
13404+
this.$signToolbar = $('<div>', {
13405+
'class': 'able-window-toolbar able-' + this.toolbarIconColor + '-controls'
13406+
});
1338713407

13388-
this.$signWindow.append(this.$signToolbar, this.$signVideo);
13408+
this.$signWindow.append(this.$signToolbar, this.$signVideo);
1338913409

13390-
this.$ableWrapper.append(this.$signWindow);
13410+
this.$ableWrapper.append(this.$signWindow);
1339113411

13392-
// make it draggable
13393-
this.initDragDrop('sign');
13412+
// make it draggable
13413+
this.initDragDrop('sign');
1339413414

13395-
if (this.prefSign === 1) {
13396-
// sign window is on. Go ahead and position it and show it
13397-
this.positionDraggableWindow('sign',this.getDefaultWidth('sign'));
13398-
}
13399-
else {
13400-
this.$signWindow.hide();
13401-
}
13402-
};
13415+
if (this.prefSign === 1) {
13416+
// sign window is on. Go ahead and position it and show it
13417+
this.positionDraggableWindow('sign', this.getDefaultWidth('sign'));
13418+
}
13419+
else {
13420+
this.$signWindow.hide();
13421+
}
13422+
};
1340313423

1340413424
})(jQuery);
1340513425

0 commit comments

Comments
 (0)