While testing the YouTube video edit preview feature for the next version of my Stack Overflow Unofficial Patch (SOUP) user script / browser extension, I stumbled across an interesting input validation bug. Specifically, when using the long-form URL syntax:
to embed YouTube videos, the server-side code that converts the links into embedded videos doesn't actually check that the value of the
v= parameter is a valid YouTube video ID (i.e. 11 base64url characters).
In particular, the embedding code doesn't check that the parameter value doesn't contain a question mark. Thus, a malformed YouTube URL like this:
will turn into the following HTML code:
<div class="youtube-embed"><div> <iframe width="640px" height="395px" src="https://www.youtube.com/embed/dQw4w9WgXcQ?autoplay=1#x?start=0" ></iframe> </div></div>
(Line breaks added and indentation cleaned up for readability.)
which will produce this:
Anyway, for what it's worth, I reported this issue to Stack Exchange via the contact form two weeks ago (ID 201711240138333429, FWIW), and got a reply saying that:
Generally, the best way to get possible bugs seen is to post it on our network's Meta site, which hosts questions and issues about the Q&A software. That way, other users and our developers can vet the problem and discuss any solutions or other potential issues.
So, here's the report. Let's hope this gets fixed now that it's been properly reported. In the mean time, enjoy your auto-playing videos. ;-)
Ps. The title was inspired by one of my earlier bug reports on meta.SE.
Pps. This bug affects all Stack Exchange sites that have YouTube embedding enabled. I chose to report it here on the Movies.SE meta, since this is one of those sites, and thus can be used to demonstrate the bug live. (Also, this is the site where I originally noticed the issue.) Anyway, SE developers have said that they track bug reports on all per-site metas, so it should be appropriate to report this here.