7

While testing the YouTube video edit preview feature for the next version of my Stack Overflow Unofficial Patch (SOUP) user script / browser extension, I stumbled across an interesting input validation bug. Specifically, when using the long-form URL syntax:

https://www.youtube.com/watch?v=VIDEOIDHERE

to embed YouTube videos, the server-side code that converts the links into embedded videos doesn't actually check that the value of the v= parameter is a valid YouTube video ID (i.e. 11 base64url characters).

In particular, the embedding code doesn't check that the parameter value doesn't contain a question mark. Thus, a malformed YouTube URL like this:

https://www.youtube.com/watch?v=dQw4w9WgXcQ?autoplay=1#x

will turn into the following HTML code:

<div class="youtube-embed"><div>
  <iframe
    width="640px" height="395px"
    src="https://www.youtube.com/embed/dQw4w9WgXcQ?autoplay=1#x?start=0"
  ></iframe>
</div></div>

(Line breaks added and indentation cleaned up for readability.)

which will produce this:

Anyway, for what it's worth, I reported this issue to Stack Exchange via the contact form two weeks ago (ID 201711240138333429, FWIW), and got a reply saying that:

Generally, the best way to get possible bugs seen is to post it on our network's Meta site, which hosts questions and issues about the Q&A software. That way, other users and our developers can vet the problem and discuss any solutions or other potential issues.

So, here's the report. Let's hope this gets fixed now that it's been properly reported. In the mean time, enjoy your auto-playing videos. ;-)


Ps. The title was inspired by one of my earlier bug reports on meta.SE.

Pps. This bug affects all Stack Exchange sites that have YouTube embedding enabled. I chose to report it here on the Movies.SE meta, since this is one of those sites, and thus can be used to demonstrate the bug live. (Also, this is the site where I originally noticed the issue.) Anyway, SE developers have said that they track bug reports on all per-site metas, so it should be appropriate to report this here.

  • 2
    Why is this an issue, and why are you reporting it here rather than on meta.stackexchange? – iandotkelly Dec 6 '17 at 20:22
  • 1
    I'm voting to close this question as off-topic because this relates to sitewide implementation of youtube embedding, and isn't specific to this site. – iandotkelly Dec 6 '17 at 20:23
  • 1
    @iandotkelly: Auto-playing YouTube videos are not normally supported in Stack Exchange posts, presumably on purpose. Meta.SE doesn't have YouTube embedding enabled, so I would not be able to demonstrate this bug there. – Ilmari Karonen Dec 6 '17 at 20:24
  • 3
    @iandotkelly That's not a valid reason to close this. Network-wide bugs can be reported on per-site metas, and YouTube embedding support is a completely valid reason to. – Undo Dec 6 '17 at 20:25
  • 1
    Not being able to demonstrate the bug isn't a good reason to not report it in the right place. You can describe this perfectly adequately. It will gather much more attention from the appropriate developers there than here. – iandotkelly Dec 6 '17 at 20:28
  • 8
    Damn, we reload pages a lot. :P And uh... yeah, sorry about that response from support. We should've looked into it. – Adam Lear Dec 6 '17 at 20:28
  • 1
    Well it looks like you got some attention the issue needs. Thanks for the report. – iandotkelly Dec 6 '17 at 20:31
  • 6
    On the other hand... if we leave this in, maybe autoplay will trick visitors into thinking we run legitimate news sites. :) – Adam Lear Dec 6 '17 at 20:40
2

This is fixed, but I feel like editing the body of the report to get it rebaked would be destroying something beautiful... so instead let's have a much more boring example embed here:

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .