PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today) (#5400)

* PRO-9467: remove defunct and nonpublic oembed providers and improve developer control to ensure security in the future (no risk exists today)

* allow newer twitter domain

* infogr.am still around

* facebook no longer does oembed

Author: boutell

.changeset/wild-forks-fetch.md

@@ -0,0 +1,15 @@
+---
+"apostrophe": minor
+---
+
+apostrophe and oembetter have been updated to eliminate a number of services that formerly supported
+oembed for the general public, but no longer do so. While there is no security risk today, removing
+these ensures that if these domains are ever allowed to lapse, they do not become an XSS
+attack vector in the future.
+
+Because oembed responses are not always iframes, it is important that this list be maintained
+over time. In addition, developers always have the option to prune it on their own by setting
+the new minimumAllowlist and minimumEndpoints options of the @apostrophecms/oembed module.
+
+Thanks to [Sainithin0309](https://github.com/Sainithin0309) for pointing out the potential
+long-term security concern.

packages/apostrophe/modules/@apostrophecms/oembed/index.js

@@ -16,10 +16,13 @@ const cheerio = require('cheerio');
 // widely trusted sites are already allowlisted.
 //
 // Your `allowlist` option is concatenated with `oembetter`'s standard
-// allowlist, plus wufoo.com, infogr.am, and slideshare.net.
+// allowlist, plus wufoo.com, infogr.am and slideshare.net.
 //
 // Your `endpoints` option is concatenated with `oembetter`'s standard
 // endpoints list.
+//
+// If you wish to completely override the behavior, set
+// `minimumAllowlist` and `minimumEndpoints` instead.
 
 module.exports = {
   options: {
@@ -42,28 +45,30 @@ module.exports = {
         // Don't permit oembed of untrusted sites, which could
         // lead to XSS attacks
 
-        self.oembetter.allowlist(self.oembetter.suggestedAllowlist.concat(
-          self.options.allowlist || [],
-          [
-            'wufoo.com',
-            'infogr.am',
-            'slideshare.net'
-          ])
-        );
+        const minimumAllowlist = self.options.minimumAllowlist || [
+          ...self.oembetter.suggestedAllowlist,
+          'wufoo.com',
+          'infogr.am',
+          'slideshare.net'
+        ];
+
+        self.oembetter.allowlist(minimumAllowlist.concat(self.options.allowlist || []));
+
+        const minimumEndpoints = self.options.minimumEndpoints || self.oembetter.suggestedEndpoints;
         self.oembetter.endpoints(
-          self.oembetter.suggestedEndpoints.concat(self.options.endpoints || [])
+          minimumEndpoints.concat(self.options.endpoints || [])
         );
       },
 
       // Enhances oembetter to support services better or to support services
-      // that have no oembed support by default. Called by `afterConstruct`.
-      // Extend this method to add additional `oembetter` filters.
+      // that have no oembed support by default.
+      //
+      // Extend or override this method to change or add oembetter filters.
 
       enhanceOembetter() {
         require('./lib/youtube.js')(self, self.oembetter);
         require('./lib/vimeo.js')(self, self.oembetter);
         require('./lib/wufoo.js')(self, self.oembetter);
-        require('./lib/infogram.js')(self, self.oembetter);
       },
 
       // This method fetches the specified URL, determines its best embedded

packages/oembetter/index.js

@@ -187,41 +187,15 @@ module.exports = function(options) {
   self.suggestedAllowlist = [
     'youtube.com',
     'youtu.be',
-    'blip.tv',
     'dailymotion.com',
     'flickr.com',
-    'hulu.com',
-    'nfb.ca',
-    'qik.com',
-    'revision3.com',
-    'scribd.com',
-    'viddler.com',
     'vimeo.com',
-    'youtube.com',
-    'dotsub.com',
-    'yfrog.com',
-    'photobucket.com',
     'soundcloud.com',
-    'instagram.com',
     'twitter.com',
-    'facebook.com'
+    'x.com'
   ];
 
   self.suggestedEndpoints = [
-    {
-      domain: 'instagram.com',
-      endpoint: 'http://api.instagram.com/oembed'
-    },
-    {
-      domain: 'facebook.com',
-      path: /\/videos\//,
-      endpoint: 'https://www.facebook.com/plugins/video/oembed.json/'
-    },
-    {
-      domain: 'facebook.com',
-      path: /\/posts\//,
-      endpoint: 'https://www.facebook.com/plugins/post/oembed.json/'
-    },
     {
       domain: 'vimeo.com',
       endpoint: 'https://vimeo.com/api/oembed.json'
@@ -233,6 +207,14 @@ module.exports = function(options) {
     {
       domain: 'youtu.be',
       endpoint: 'https://www.youtube.com/oembed'
+    },
+    {
+      domain: 'twitter.com',
+      endpoint: 'https://publish.twitter.com/oembed'
+    },
+    {
+      domain: 'x.com',
+      endpoint: 'https://publish.twitter.com/oembed'
     }
   ];