From 9923df7b1954b836aeac74104abaf3eba3e4c750 Mon Sep 17 00:00:00 2001
From: Sean Yesmunt <sean@lbry.io>
Date: Wed, 29 Apr 2020 17:37:14 -0400
Subject: [PATCH] let browser validate iframe markup

---
 ui/component/common/markdown-preview.jsx | 19 ++++++++++++++++---
 ui/modal/modalPublish/view.jsx           |  2 +-
 2 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/ui/component/common/markdown-preview.jsx b/ui/component/common/markdown-preview.jsx
index bfbdd3169..a2018b15e 100644
--- a/ui/component/common/markdown-preview.jsx
+++ b/ui/component/common/markdown-preview.jsx
@@ -80,13 +80,26 @@ const schema = { ...defaultSchema };
 schema.protocols.href.push('lbry');
 schema.attributes.a.push('embed');
 
-const REPLACE_REGEX = /(<iframe src=")(.*?(?=))("><\/iframe>)/g;
+const REPLACE_REGEX = /(<iframe\s+src=["'])(.*?(?=))(["']\s*><\/iframe>)/g;
 
 const MarkdownPreview = (props: MarkdownProps) => {
   const { content, strip, promptLinks } = props;
   const strippedContent = content
-    ? content.replace(REPLACE_REGEX, (x, y, iframeSrc) => {
-        return `${iframeSrc}?embed=true`;
+    ? content.replace(REPLACE_REGEX, (iframeHtml, y, iframeSrc) => {
+        // Let the browser try to create an iframe to see if the markup is valid
+        const outer = document.createElement('div');
+        outer.innerHTML = iframeHtml;
+        const iframe = ((outer.querySelector('iframe'): any): ?HTMLIFrameElement);
+
+        if (iframe) {
+          const src = iframe.src;
+
+          if (src && src.startsWith('lbry://')) {
+            return `${src}?embed=true`;
+          }
+        }
+
+        return iframeHtml;
       })
     : '';
 
diff --git a/ui/modal/modalPublish/view.jsx b/ui/modal/modalPublish/view.jsx
index 3fd1b3db6..aba94efdb 100644
--- a/ui/modal/modalPublish/view.jsx
+++ b/ui/modal/modalPublish/view.jsx
@@ -50,7 +50,7 @@ class ModalPublishSuccess extends React.PureComponent<Props> {
             </React.Fragment>
           }
           actions={
-            <div className="card__actions">
+            <div className="section__actions">
               <Button
                 button="primary"
                 label={__('View My Publishes')}