Allow video and audio elements in work content

Description

General

Users should be able to embed video and audio in their work content using the video and audio elements. They should not be able to use these elements in other fields.

We should allow simple video and audio elements (e.g. <video src="video url"></video>) and more complex ones with multiple source and track elements and fallback content, e.g.

Video

Attributes and values that should be automatically added on the video element:

  • controls

  • crossorigin="anonymous"

  • playsinline

  • preload="metadata"

Attributes that should be allowed on the video element:

  • class

  • dir

  • height

  • loop

  • muted

  • poster, but it's important to restrict the value to URLs and not JavaScript fragments due to an Opera 10.5 exploit

  • src

  • title

  • width

Audio

Attributes and values that should be automatically added on the audio element:

  • controls

  • crossorigin="anonymous"

  • preload="metadata"

Attributes that should be allowed on the audio element:

  • class

  • dir

  • loop

  • muted

  • src

  • title

Source

Attributes that should be allowed for the source element:

  • src

  • type

Track

Attributes that should be allowed for the track element:

  • default

  • kind

  • label

  • src

  • srclang

Blacklist

The src URLs of video, audio, source, and track elements should be checked against a single domain blacklist in the config file. This will allow us to block embeds from certain domains in case of abuse.

Initially, the blacklist should be empty.

Testing

Because this also does some refactoring, in addition to making sure the new audio and video tags and their attributes work, we should make sure that the current HTML tags continue to work. Please refer to the “HTML Tag Regression” page on the wiki for instructions.

For testing the audio and video tags:

Elz 20:39

this site has some good examples of things we want to strip out: https://html5sec.org/

just ctrl-f for audio and video

If you need some audio:

Elz 09:53

if anyone wants to test audio, wikipedia doesn't seem to block hotlinks:https://en.wikipedia.org/wiki/List_of_animal_sounds

And if you need some more info on the elements:

 

Environment

None

Status

Assignee

elzj78 (Elz)

Reporter

Sarken

Roadmap

Works

Priority

Medium

Affects versions

Fix versions

Components

BackEnd

Difficulty

Medium

Required Access Level

None

Milestone

Internal 0.9
Configure