Skip to content

OEmbed providers: Tighten up resource URL matching for providers #21583

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
AndyButland merged 9 commits into from
Feb 5, 2026
Merged

OEmbed providers: Tighten up resource URL matching for providers #21583

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
c10e0c5
edit regex for oembed flickr
LanThuyNguyen Jan 30, 2026
49abc3b
Merge branch 'main' into v17/fix-bug/validation-oembed
AndyButland Feb 3, 2026
02cceb2
Apply stricter matching with domain to all embed providers, and valid…
AndyButland Feb 3, 2026
20db9a8
Resolved warnings and added further unit tests.
AndyButland Feb 3, 2026
7e4ee22
Further tightened the URL matching regex for two providers.
AndyButland Feb 3, 2026
7daff95
Add regex caching to OEmbedService and unit tests to verify behaviour.
AndyButland Feb 3, 2026
6ac3f63
Restore flickr short URL domain.
AndyButland Feb 3, 2026
4a76cd4
Merge branch 'main' into v17/fix-bug/validation-oembed
NguyenThuyLan Feb 5, 2026
d334158
Use https in requests to oembed providers.
AndyButland Feb 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 6 additions & 7 deletions src/Umbraco.Core/Media/EmbedProviders/DailyMotion.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,3 @@
using System.Xml;
using Umbraco.Cms.Core.Serialization;

namespace Umbraco.Cms.Core.Media.EmbedProviders;
Expand All @@ -9,28 +8,28 @@ namespace Umbraco.Cms.Core.Media.EmbedProviders;
public class DailyMotion : OEmbedProviderBase
{
/// <summary>
/// Initializes a new instance of the <see cref="DailyMotion"/> class.
/// Initializes a new instance of the <see cref="DailyMotion"/> class.
/// </summary>
/// <param name="jsonSerializer">The JSON serializer.</param>
public DailyMotion(IJsonSerializer jsonSerializer)
: base(jsonSerializer)
{
}

/// <inheritdoc />
/// <inheritdoc/>
public override string ApiEndpoint => "https://www.dailymotion.com/services/oembed";

/// <inheritdoc />
public override string[] UrlSchemeRegex => new[] { @"dailymotion.com/video/.*" };
/// <inheritdoc/>
public override string[] UrlSchemeRegex => [@"^https?:\/\/(www\.)?dailymotion\.com\/video\/"];

/// <inheritdoc />
/// <inheritdoc/>
public override Dictionary<string, string> RequestParams => new()
{
// ApiUrl/?format=xml
{ "format", "xml" },
};

/// <inheritdoc />
/// <inheritdoc/>
public override async Task<string?> GetMarkupAsync(string url, int? maxWidth, int? maxHeight, CancellationToken cancellationToken)
=> await GetXmlBasedMarkupAsync(url, maxWidth, maxHeight, cancellationToken);
}
42 changes: 31 additions & 11 deletions src/Umbraco.Core/Media/EmbedProviders/Flickr.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,34 +10,54 @@ namespace Umbraco.Cms.Core.Media.EmbedProviders;
public class Flickr : OEmbedProviderBase
{
/// <summary>
/// Initializes a new instance of the <see cref="Flickr"/> class.
/// Initializes a new instance of the <see cref="Flickr"/> class.
/// </summary>
/// <param name="jsonSerializer">The JSON serializer.</param>
public Flickr(IJsonSerializer jsonSerializer)
: base(jsonSerializer)
{
}

/// <inheritdoc />
public override string ApiEndpoint => "http://www.flickr.com/services/oembed/";
/// <inheritdoc/>
public override string ApiEndpoint => "https://www.flickr.com/services/oembed/";

/// <inheritdoc />
public override string[] UrlSchemeRegex => new[] { @"flickr.com\/photos\/*", @"flic.kr\/p\/*" };
/// <inheritdoc/>
public override string[] UrlSchemeRegex =>
[
@"^https?:\/\/(www\.)?flickr\.com\/photos\/",
@"^https?:\/\/flic\.kr\/p\/",
];

/// <inheritdoc />
public override Dictionary<string, string> RequestParams => new();
/// <inheritdoc/>
public override Dictionary<string, string> RequestParams => [];

/// <inheritdoc />
/// <inheritdoc/>
public override async Task<string?> GetMarkupAsync(string url, int? maxWidth, int? maxHeight, CancellationToken cancellationToken)
{
var requestUrl = base.GetEmbedProviderUrl(url, maxWidth, maxHeight);
XmlDocument xmlDocument = await base.GetXmlResponseAsync(requestUrl, cancellationToken);
var requestUrl = GetEmbedProviderUrl(url, maxWidth, maxHeight);
XmlDocument xmlDocument = await GetXmlResponseAsync(requestUrl, cancellationToken);

return BuildMarkup(xmlDocument);
}

/// <summary>
/// Builds an img tag from the oEmbed XML response.
/// </summary>
/// <param name="xmlDocument">The XML document from the oEmbed API.</param>
/// <returns>An HTML img tag string.</returns>
/// <remarks>Internal to support unit testing.</remarks>
internal string BuildMarkup(XmlDocument xmlDocument)
{
var imageUrl = GetXmlProperty(xmlDocument, "/oembed/url");
var imageWidth = GetXmlProperty(xmlDocument, "/oembed/width");
var imageHeight = GetXmlProperty(xmlDocument, "/oembed/height");
var imageTitle = GetXmlProperty(xmlDocument, "/oembed/title");

return string.Format("<img src=\"{0}\" width=\"{1}\" height=\"{2}\" alt=\"{3}\" />", imageUrl, imageWidth, imageHeight, WebUtility.HtmlEncode(imageTitle));
return string.Format(
"<img src=\"{0}\" width=\"{1}\" height=\"{2}\" alt=\"{3}\" />",
imageUrl,
imageWidth,
imageHeight,
WebUtility.HtmlEncode(imageTitle));
}
}
27 changes: 16 additions & 11 deletions src/Umbraco.Core/Media/EmbedProviders/GettyImages.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,27 +8,32 @@ namespace Umbraco.Cms.Core.Media.EmbedProviders;
public class GettyImages : OEmbedProviderBase
{
/// <summary>
/// Initializes a new instance of the <see cref="GettyImages"/> class.
/// Initializes a new instance of the <see cref="GettyImages"/> class.
/// </summary>
/// <param name="jsonSerializer">The JSON serializer.</param>
public GettyImages(IJsonSerializer jsonSerializer)
: base(jsonSerializer)
{
}

/// <inheritdoc />
public override string ApiEndpoint => "http://embed.gettyimages.com/oembed";
/// <inheritdoc/>
public override string ApiEndpoint => "https://embed.gettyimages.com/oembed";

// http://gty.im/74917285
// http://www.gettyimages.com/detail/74917285
/// <inheritdoc/>
/// <example>
/// https://gty.im/74917285
/// https://www.gettyimages.com/detail/74917285
/// </example>
public override string[] UrlSchemeRegex =>
[
@"^https?:\/\/(www\.)?gty\.im\/",
@"^https?:\/\/(www\.)?gettyimages\.com\/detail\/",
];

/// <inheritdoc />
public override string[] UrlSchemeRegex => new[] { @"gty\.im/*", @"gettyimages.com\/detail\/*" };
/// <inheritdoc/>
public override Dictionary<string, string> RequestParams => [];

/// <inheritdoc />
public override Dictionary<string, string> RequestParams => new();

/// <inheritdoc />
/// <inheritdoc/>
public override async Task<string?> GetMarkupAsync(string url, int? maxWidth, int? maxHeight, CancellationToken cancellationToken)
=> await GetJsonBasedMarkupAsync(url, maxWidth, maxHeight, cancellationToken);
}
18 changes: 11 additions & 7 deletions src/Umbraco.Core/Media/EmbedProviders/Giphy.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,24 +8,28 @@ namespace Umbraco.Cms.Core.Media.EmbedProviders;
public class Giphy : OEmbedProviderBase
{
/// <summary>
/// Initializes a new instance of the <see cref="Giphy"/> class.
/// Initializes a new instance of the <see cref="Giphy"/> class.
/// </summary>
/// <param name="jsonSerializer">The JSON serializer.</param>
public Giphy(IJsonSerializer jsonSerializer)
: base(jsonSerializer)
{
}

/// <inheritdoc />
/// <inheritdoc/>
public override string ApiEndpoint => "https://giphy.com/services/oembed?url=";

/// <inheritdoc />
public override string[] UrlSchemeRegex => new[] { @"giphy\.com/*", @"gph\.is/*" };
/// <inheritdoc/>
public override string[] UrlSchemeRegex =>
[
@"^https?:\/\/(www\.)?giphy\.com\/",
@"^https?:\/\/(www\.)?gph\.is\/",
];

/// <inheritdoc />
public override Dictionary<string, string> RequestParams => new();
/// <inheritdoc/>
public override Dictionary<string, string> RequestParams => [];

/// <inheritdoc />
/// <inheritdoc/>
public override async Task<string?> GetMarkupAsync(string url, int? maxWidth, int? maxHeight, CancellationToken cancellationToken)
=> await GetJsonBasedMarkupAsync(url, maxWidth, maxHeight, cancellationToken);
}
16 changes: 8 additions & 8 deletions src/Umbraco.Core/Media/EmbedProviders/Hulu.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,24 +8,24 @@ namespace Umbraco.Cms.Core.Media.EmbedProviders;
public class Hulu : OEmbedProviderBase
{
/// <summary>
/// Initializes a new instance of the <see cref="Hulu"/> class.
/// Initializes a new instance of the <see cref="Hulu"/> class.
/// </summary>
/// <param name="jsonSerializer">The JSON serializer.</param>
public Hulu(IJsonSerializer jsonSerializer)
: base(jsonSerializer)
{
}

/// <inheritdoc />
public override string ApiEndpoint => "http://www.hulu.com/api/oembed.json";
/// <inheritdoc/>
public override string ApiEndpoint => "https://www.hulu.com/api/oembed.json";

/// <inheritdoc />
public override string[] UrlSchemeRegex => new[] { @"hulu.com/watch/.*" };
/// <inheritdoc/>
public override string[] UrlSchemeRegex => [@"^https?:\/\/(www\.)?hulu\.com\/watch\/"];

/// <inheritdoc />
public override Dictionary<string, string> RequestParams => new();
/// <inheritdoc/>
public override Dictionary<string, string> RequestParams => [];

/// <inheritdoc />
/// <inheritdoc/>
public override async Task<string?> GetMarkupAsync(string url, int? maxWidth, int? maxHeight, CancellationToken cancellationToken)
=> await GetJsonBasedMarkupAsync(url, maxWidth, maxHeight, cancellationToken);
}
13 changes: 6 additions & 7 deletions src/Umbraco.Core/Media/EmbedProviders/Issuu.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,3 @@
using System.Xml;
using Umbraco.Cms.Core.Serialization;

namespace Umbraco.Cms.Core.Media.EmbedProviders;
Expand All @@ -9,21 +8,21 @@ namespace Umbraco.Cms.Core.Media.EmbedProviders;
public class Issuu : OEmbedProviderBase
{
/// <summary>
/// Initializes a new instance of the <see cref="Issuu"/> class.
/// Initializes a new instance of the <see cref="Issuu"/> class.
/// </summary>
/// <param name="jsonSerializer">The JSON serializer.</param>
public Issuu(IJsonSerializer jsonSerializer)
: base(jsonSerializer)
{
}

/// <inheritdoc />
/// <inheritdoc/>
public override string ApiEndpoint => "https://issuu.com/oembed";

/// <inheritdoc />
public override string[] UrlSchemeRegex => new[] { @"issuu.com/.*/docs/.*" };
/// <inheritdoc/>
public override string[] UrlSchemeRegex => [@"^https?:\/\/(www\.)?issuu\.com\/[^\/]+\/docs\/"];

/// <inheritdoc />
/// <inheritdoc/>
public override Dictionary<string, string> RequestParams => new()
{
// ApiUrl/?iframe=true
Expand All @@ -33,7 +32,7 @@ public Issuu(IJsonSerializer jsonSerializer)
{ "format", "xml" },
};

/// <inheritdoc />
/// <inheritdoc/>
public override async Task<string?> GetMarkupAsync(string url, int? maxWidth, int? maxHeight, CancellationToken cancellationToken)
=> await GetXmlBasedMarkupAsync(url, maxWidth, maxHeight, cancellationToken);
}
16 changes: 8 additions & 8 deletions src/Umbraco.Core/Media/EmbedProviders/Kickstarter.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,24 +8,24 @@ namespace Umbraco.Cms.Core.Media.EmbedProviders;
public class Kickstarter : OEmbedProviderBase
{
/// <summary>
/// Initializes a new instance of the <see cref="Kickstarter"/> class.
/// Initializes a new instance of the <see cref="Kickstarter"/> class.
/// </summary>
/// <param name="jsonSerializer">The JSON serializer.</param>
public Kickstarter(IJsonSerializer jsonSerializer)
: base(jsonSerializer)
{
}

/// <inheritdoc />
public override string ApiEndpoint => "http://www.kickstarter.com/services/oembed";
/// <inheritdoc/>
public override string ApiEndpoint => "https://www.kickstarter.com/services/oembed";

/// <inheritdoc />
public override string[] UrlSchemeRegex => new[] { @"kickstarter\.com/projects/*" };
/// <inheritdoc/>
public override string[] UrlSchemeRegex => [@"^https?:\/\/(www\.)?kickstarter\.com\/projects\/"];

/// <inheritdoc />
public override Dictionary<string, string> RequestParams => new();
/// <inheritdoc/>
public override Dictionary<string, string> RequestParams => [];

/// <inheritdoc />
/// <inheritdoc/>
public override async Task<string?> GetMarkupAsync(string url, int? maxWidth, int? maxHeight, CancellationToken cancellationToken)
=> await GetJsonBasedMarkupAsync(url, maxWidth, maxHeight, cancellationToken);
}
50 changes: 35 additions & 15 deletions src/Umbraco.Core/Media/EmbedProviders/LottieFiles.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,53 +6,73 @@ namespace Umbraco.Cms.Core.Media.EmbedProviders;
/// <summary>
/// Embed Provider for lottiefiles.com the popular opensource JSON-based animation format platform.
/// </summary>
public class LottieFiles : OEmbedProviderBase
public partial class LottieFiles : OEmbedProviderBase
{
/// <summary>
/// Initializes a new instance of the <see cref="LottieFiles"/> class.
/// Initializes a new instance of the <see cref="LottieFiles"/> class.
/// </summary>
/// <param name="jsonSerializer">The JSON serializer.</param>
public LottieFiles(IJsonSerializer jsonSerializer)
: base(jsonSerializer)
{
}

/// <inheritdoc />
/// <inheritdoc/>
public override string ApiEndpoint => "https://embed.lottiefiles.com/oembed";

/// <inheritdoc />
public override string[] UrlSchemeRegex => new[] { @"lottiefiles\.com/*" };
/// <inheritdoc/>
public override string[] UrlSchemeRegex => [@"^https?:\/\/(www\.)?lottiefiles\.com\/"];

/// <inheritdoc />
public override Dictionary<string, string> RequestParams => new();
/// <inheritdoc/>
public override Dictionary<string, string> RequestParams => [];

/// <inheritdoc />
/// <inheritdoc/>
public override async Task<string?> GetMarkupAsync(string url, int? maxWidth, int? maxHeight, CancellationToken cancellationToken)
{
var requestUrl = GetEmbedProviderUrl(url, maxWidth, maxHeight);
OEmbedResponse? oembed = await GetJsonResponseAsync<OEmbedResponse>(requestUrl, cancellationToken);
var html = oembed?.GetHtml();

// LottieFiles doesn't seem to support maxwidth and maxheight via oembed
// this is therefore a hack... with regexes.. is that ok? HtmlAgility etc etc
// otherwise it always defaults to 300...
return BuildMarkup(html, maxWidth, maxHeight);
}

/// <summary>
/// Builds the markup by replacing dimensions in the HTML.
/// </summary>
/// <param name="html">The HTML from the oEmbed response.</param>
/// <param name="maxWidth">The maximum width, or null.</param>
/// <param name="maxHeight">The maximum height, or null.</param>
/// <returns>The HTML with replaced dimensions, or null if input is null.</returns>
/// <remarks>
/// LottieFiles doesn't support maxwidth and maxheight via oEmbed,
/// so we replace the dimensions manually using regex.
/// Internal to support unit testing.
/// </remarks>
internal static string? BuildMarkup(string? html, int? maxWidth, int? maxHeight)
{
if (html is null)
{
return null;
}

if (maxWidth > 0 && maxHeight > 0)
{
html = Regex.Replace(html, "width=\"([0-9]{1,4})\"", "width=\"" + maxWidth + "\"");
html = Regex.Replace(html, "height=\"([0-9]{1,4})\"", "height=\"" + maxHeight + "\"");
html = WidthAttributeRegex().Replace(html, "width=\"" + maxWidth + "\"");
html = HeightAttributeRegex().Replace(html, "height=\"" + maxHeight + "\"");
}
else
{
// if set to 0, let's default to 100% as an easter egg
html = Regex.Replace(html, "width=\"([0-9]{1,4})\"", "width=\"100%\"");
html = Regex.Replace(html, "height=\"([0-9]{1,4})\"", "height=\"100%\"");
html = WidthAttributeRegex().Replace(html, "width=\"100%\"");
html = HeightAttributeRegex().Replace(html, "height=\"100%\"");
}

return html;
}

[GeneratedRegex("width=\"([0-9]{1,4})\"", RegexOptions.Compiled)]
private static partial Regex WidthAttributeRegex();

[GeneratedRegex("height=\"([0-9]{1,4})\"", RegexOptions.Compiled)]
private static partial Regex HeightAttributeRegex();
}
Loading
Loading