11

While testing the YouTube video edit preview feature for the next version of my Stack Overflow Unofficial Patch (SOUP) user script / browser extension, I stumbled across an interesting input validation bug. Specifically, when using the long-form URL syntax:

https://www.youtube.com/watch?v=VIDEOIDHERE

to embed YouTube videos, the server-side code that converts the links into embedded videos doesn't actually check that the value of the v= parameter is a valid YouTube video ID (i.e. 11 base64url characters).

In particular, the embedding code doesn't check that the parameter value doesn't contain a question mark. Thus, a malformed YouTube URL like this:

https://www.youtube.com/watch?v=dQw4w9WgXcQ?autoplay=1#x

will turn into the following HTML code:

<div class="youtube-embed"><div>
  <iframe
    width="640px" height="395px"
    src="https://www.youtube.com/embed/dQw4w9WgXcQ?autoplay=1#x?start=0"
  ></iframe>
</div></div>

(Line breaks added and indentation cleaned up for readability.)

which will produce this:

Anyway, for what it's worth, I reported this issue to Stack Exchange via the contact form two weeks ago (ID 201711240138333429, FWIW), and got a reply saying that:

Generally, the best way to get possible bugs seen is to post it on our network's Meta site, which hosts questions and issues about the Q&A software. That way, other users and our developers can vet the problem and discuss any solutions or other potential issues.

So, here's the report. Let's hope this gets fixed now that it's been properly reported. In the mean time, enjoy your auto-playing videos. ;-)

Ps. The title was inspired by one of my earlier bug reports on meta.SE.

Pps. This bug affects all Stack Exchange sites that have YouTube embedding enabled. I chose to report it here on the Movies.SE meta, since this is one of those sites, and thus can be used to demonstrate the bug live. (Also, this is the site where I originally noticed the issue.) Anyway, SE developers have said that they track bug reports on all per-site metas, so it should be appropriate to report this here.

9
  • 2
    Why is this an issue, and why are you reporting it here rather than on meta.stackexchange?
    – iandotkelly Mod
    Dec 6, 2017 at 20:22
  • 1
    I'm voting to close this question as off-topic because this relates to sitewide implementation of youtube embedding, and isn't specific to this site.
    – iandotkelly Mod
    Dec 6, 2017 at 20:23
  • 2
    @iandotkelly: Auto-playing YouTube videos are not normally supported in Stack Exchange posts, presumably on purpose. Meta.SE doesn't have YouTube embedding enabled, so I would not be able to demonstrate this bug there.
    – Ilmari Karonen
    Dec 6, 2017 at 20:24
  • 3
    @iandotkelly That's not a valid reason to close this. Network-wide bugs can be reported on per-site metas, and YouTube embedding support is a completely valid reason to.
    – Undo
    Dec 6, 2017 at 20:25
  • 1
    Not being able to demonstrate the bug isn't a good reason to not report it in the right place. You can describe this perfectly adequately. It will gather much more attention from the appropriate developers there than here.
    – iandotkelly Mod
    Dec 6, 2017 at 20:28
  • 11
    Damn, we reload pages a lot. :P And uh... yeah, sorry about that response from support. We should've looked into it.
    – Adam Lear StaffMod
    Dec 6, 2017 at 20:28
  • 1
    Well it looks like you got some attention the issue needs. Thanks for the report.
    – iandotkelly Mod
    Dec 6, 2017 at 20:31
  • 9
    On the other hand... if we leave this in, maybe autoplay will trick visitors into thinking we run legitimate news sites. :)
    – Adam Lear StaffMod
    Dec 6, 2017 at 20:40
  • Alas, looks like something has changed in the past two years so that this live demo no longer works. Oh well. It had its day, but it's probably better this way. :/
    – Ilmari Karonen
    Mar 5, 2020 at 20:24

1 Answer 1

Reset to default
5

This is fixed, but I feel like editing the body of the report to get it rebaked would be destroying something beautiful... so instead let's have a much more boring example embed here:

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .