From 01fbd3c54eaa36f57af2fc5b2c25e3438d2e8482 Mon Sep 17 00:00:00 2001
From: calzoneman <calzoneman@gmail.com>
Date: Thu, 18 Jun 2015 18:46:33 -0400
Subject: [PATCH] Work on custom embeds

---
 lib/customembed.js           | 100 ++++++++++++++++++++++++++++++-----
 lib/get-info.js              |  13 ++++-
 lib/media.js                 |   3 +-
 player/custom-embed.coffee   |  46 ++++++++++++++++
 player/generic-iframe.coffee |  28 ++++++++++
 player/update.coffee         |   1 +
 www/js/player-new.js         |  66 ++++++++++++++++++++++-
 7 files changed, 239 insertions(+), 18 deletions(-)
 create mode 100644 player/custom-embed.coffee
 create mode 100644 player/generic-iframe.coffee

diff --git a/lib/customembed.js b/lib/customembed.js
index e5e7ef90..c2923f16 100644
--- a/lib/customembed.js
+++ b/lib/customembed.js
@@ -1,22 +1,96 @@
-const allowed = ["iframe", "object", "param", "embed"];
-const tag_re = /<\s*\/?\s*([a-z]+)(\s*([a-z]+)\s*=\s*('[^']*'|"[^"]*"|[^"'>]*))*\s*>/ig;
+var cheerio = require("cheerio");
+var crypto = require("crypto");
+var Media = require("./media");
 
-function filter(str) {
-    if (typeof str !== "string") {
-        return "";
+function sha256(input) {
+    var hash = crypto.createHash("sha256");
+    hash.update(input);
+    return hash.digest("base64");
+}
+
+function filter(input) {
+    var $ = cheerio.load(input, { xmlMode: true });
+    var meta = getMeta($);
+    var id = "cu:" + sha256(input);
+
+    return new Media(id, "Custom Media", "--:--", "cu", meta);
+}
+
+function getMeta($) {
+    var tag = $("embed");
+    if (tag.length !== 0) {
+        return filterEmbed(tag[0]);
+    }
+    tag = $("object");
+    if (tag.length !== 0) {
+        return filterObject(tag[0]);
+    }
+    tag = $("iframe");
+    if (tag.length !== 0) {
+        return filterIframe(tag[0]);
     }
 
-    str = str.replace(tag_re, function (match, tag) {
-        if(!~allowed.indexOf(tag.toLowerCase())) {
-            return match.replace("<", "&lt;").replace(">", "&gt;");
+    throw new Error("Invalid embed.  Input must be an <iframe>, <object>, or " +
+                    "<embed> tag.");
+}
+
+const ALLOWED_PARAMS = /^(flashvars|bgcolor|movie)$/i;
+function filterEmbed(tag) {
+    if (tag.attribs.type !== "application/x-shockwave-flash") {
+        throw new Error("Invalid embed. Only type 'application/x-shockwave-flash' " +
+                        "is allowed for <embed> tags.");
+    }
+
+    var meta = {
+        embed: {
+            tag: "object",
+            src: tag.attribs.src,
+            params: {}
         }
-        return match;
-    });
-    str = str.replace(/(\bon\w*\s*=\s*('[^']*'|"[^"]"|[^\s><]*))/ig, function () {
-        return "";
+    }
+
+    for (var key in tag.attribs) {
+        if (ALLOWED_PARAMS.test(key)) {
+            meta.embed.params[key] = tag.attribs[key];
+        }
+    }
+
+    return meta;
+}
+
+function filterObject(tag) {
+    if (tag.attribs.type !== "application/x-shockwave-flash") {
+        throw new Error("Invalid embed. Only type 'application/x-shockwave-flash' " +
+                        "is allowed for <embed> tags.");
+    }
+
+    var meta = {
+        embed: {
+            tag: "object",
+            src: tag.attribs.data,
+            params: {}
+        }
+    };
+
+    tag.children.forEach(function (child) {
+        if (child.name !== "param") return;
+        if (!ALLOWED_PARAMS.test(child.attribs.name)) return;
+
+        meta.embed.params[child.attribs.name] = child.attribs.value;
     });
 
-    return str.substring(0, 20000);
+    return meta;
+}
+
+function filterIframe(tag) {
+    var meta = {
+        embed: {
+            tag: "iframe",
+            src: tag.attribs.src
+        }
+    };
+
+    return meta;
 }
 
 exports.filter = filter;
diff --git a/lib/get-info.js b/lib/get-info.js
index 684deb21..0925eaa7 100644
--- a/lib/get-info.js
+++ b/lib/get-info.js
@@ -510,8 +510,17 @@ var Getters = {
 
     /* custom embed */
     cu: function (id, callback) {
-        id = CustomEmbedFilter(id);
-        var media = new Media(id, "Custom Media", "--:--", "cu");
+        var media;
+        try {
+            media = CustomEmbedFilter(id);
+        } catch (e) {
+            if (/invalid embed/i.test(e.message)) {
+                return callback(e.message);
+            } else {
+                Logger.errlog.log(e.stack);
+                return callback("Unknown error processing embed");
+            }
+        }
         callback(false, media);
     },
 
diff --git a/lib/media.js b/lib/media.js
index 4faec19e..8aa3d56e 100644
--- a/lib/media.js
+++ b/lib/media.js
@@ -37,7 +37,8 @@ Media.prototype = {
                 restricted: this.meta.restricted,
                 codec: this.meta.codec,
                 bitrate: this.meta.bitrate,
-                scuri: this.meta.scuri
+                scuri: this.meta.scuri,
+                embed: this.meta.embed
             }
         };
     },
diff --git a/player/custom-embed.coffee b/player/custom-embed.coffee
new file mode 100644
index 00000000..84bcb199
--- /dev/null
+++ b/player/custom-embed.coffee
@@ -0,0 +1,46 @@
+genParam = (name, value) ->
+    $('<param/>').attr(
+        name: name
+        value: value
+    )
+
+window.CustomEmbedPlayer = class CustomEmbedPlayer extends Player
+    constructor: (data) ->
+        if not (this instanceof CustomEmbedPlayer)
+            return new CustomEmbedPlayer(data)
+
+        @load(data)
+
+    load: (data) ->
+        embed = data.meta.embed
+        if not embed?
+            console.error('CustomEmbedPlayer::load(): missing meta.embed')
+            return
+
+        if embed.tag == 'object'
+            @player = @loadObject(embed)
+        else
+            @player = @loadIframe(embed)
+
+        removeOld(@player)
+
+    loadObject: (embed) ->
+        object = $('<object/>').attr(
+            type: 'application/x-shockwave-flash'
+            data: embed.src
+        )
+        genParam('allowfullscreen', 'true').appendTo(object)
+        genParam('allowscriptaccess', 'always').appendTo(object)
+
+        for key, value of embed.params
+            genParam(key, value).appendTo(object)
+
+        return object
+
+    loadIframe: (embed) ->
+        iframe = $('<iframe/>').attr(
+            src: embed.src
+            frameborder: '0'
+        )
+
+        return iframe
diff --git a/player/generic-iframe.coffee b/player/generic-iframe.coffee
new file mode 100644
index 00000000..adb621b2
--- /dev/null
+++ b/player/generic-iframe.coffee
@@ -0,0 +1,28 @@
+DEFAULT_WARNING = 'You are currently connected via HTTPS but the embedded video
+    link uses non-secure plain HTTP.  Your browser may therefore block it from
+    loading due to mixed content policy.  To fix this, embed the video using a
+    secure link if available (https://...), or load this page over plain HTTP by
+    replacing "https://" with "http://" in the address bar (your websocket will
+    still be secured using HTTPS, but this will permit non-secure content to load).'
+
+window.GenericIframePlayer = class GenericIframePlayer extends Player
+    constructor: (data, iframeSrc, customMixedContentWarning) ->
+        if not (this instanceof GenericIframePlayer)
+            return new GenericIframePlayer(data, iframeSrc, customMixedContentWarning)
+
+    load: (data, iframeSrc, customMixedContentWarning) ->
+        @setMediaProperties(data)
+
+        @player = $('<iframe/>').attr(
+            src: iframeSrc
+            frameborder: '0'
+        )
+        removeOld(@player)
+
+        if iframeSrc.indexOf('http:') == 0
+            if customMixedContentWarning
+                warning = customMixedContentWarning
+            else
+                warning = DEFAULT_WARNING
+
+            makeAlert('Mixed Content Warning', warning).appendTo($('#videowrap'))
diff --git a/player/update.coffee b/player/update.coffee
index 842d6c95..77686b8b 100644
--- a/player/update.coffee
+++ b/player/update.coffee
@@ -7,6 +7,7 @@ TYPE_MAP =
     sc: SoundCloudPlayer
     li: LivestreamPlayer
     tw: TwitchPlayer
+    cu: CustomEmbedPlayer
 
 window.loadMediaPlayer = (data) ->
     if data.type of TYPE_MAP
diff --git a/www/js/player-new.js b/www/js/player-new.js
index 3eb19df5..bacf2793 100644
--- a/www/js/player-new.js
+++ b/www/js/player-new.js
@@ -1,5 +1,5 @@
 (function() {
-  var DailymotionPlayer, LivestreamPlayer, Player, SoundCloudPlayer, TYPE_MAP, TwitchPlayer, VideoJSPlayer, VimeoPlayer, YouTubePlayer, sortSources,
+  var CustomEmbedPlayer, DailymotionPlayer, LivestreamPlayer, Player, SoundCloudPlayer, TYPE_MAP, TwitchPlayer, VideoJSPlayer, VimeoPlayer, YouTubePlayer, genParam, sortSources,
     extend = function(child, parent) { for (var key in parent) { if (hasProp.call(parent, key)) child[key] = parent[key]; } function ctor() { this.constructor = child; } ctor.prototype = parent.prototype; child.prototype = new ctor(); child.__super__ = parent.prototype; return child; },
     hasProp = {}.hasOwnProperty;
 
@@ -786,6 +786,67 @@
 
   })(Player);
 
+  genParam = function(name, value) {
+    return $('<param/>').attr({
+      name: name,
+      value: value
+    });
+  };
+
+  window.CustomEmbedPlayer = CustomEmbedPlayer = (function(superClass) {
+    extend(CustomEmbedPlayer, superClass);
+
+    function CustomEmbedPlayer(data) {
+      if (!(this instanceof CustomEmbedPlayer)) {
+        return new CustomEmbedPlayer(data);
+      }
+      this.load(data);
+    }
+
+    CustomEmbedPlayer.prototype.load = function(data) {
+      var embed;
+      embed = data.meta.embed;
+      if (embed == null) {
+        console.error('CustomEmbedPlayer::load(): missing meta.embed');
+        return;
+      }
+      if (embed.tag === 'object') {
+        this.player = this.loadObject(embed);
+      } else {
+        this.player = this.loadIframe(embed);
+      }
+      return removeOld(this.player);
+    };
+
+    CustomEmbedPlayer.prototype.loadObject = function(embed) {
+      var key, object, ref, value;
+      object = $('<object/>').attr({
+        type: 'application/x-shockwave-flash',
+        data: embed.src
+      });
+      genParam('allowfullscreen', 'true').appendTo(object);
+      genParam('allowscriptaccess', 'always').appendTo(object);
+      ref = embed.params;
+      for (key in ref) {
+        value = ref[key];
+        genParam(key, value).appendTo(object);
+      }
+      return object;
+    };
+
+    CustomEmbedPlayer.prototype.loadIframe = function(embed) {
+      var iframe;
+      iframe = $('<iframe/>').attr({
+        src: embed.src,
+        frameborder: '0'
+      });
+      return iframe;
+    };
+
+    return CustomEmbedPlayer;
+
+  })(Player);
+
   TYPE_MAP = {
     yt: YouTubePlayer,
     vi: VimeoPlayer,
@@ -794,7 +855,8 @@
     gp: VideoJSPlayer,
     sc: SoundCloudPlayer,
     li: LivestreamPlayer,
-    tw: TwitchPlayer
+    tw: TwitchPlayer,
+    cu: CustomEmbedPlayer
   };
 
   window.loadMediaPlayer = function(data) {