Safer iframe creation

1 files changed, 9 insertions, 9 deletions

diff --git a/client/src/assets/player/utils.ts b/client/src/assets/player/utils.ts
index f2e9adb14..cbca1065f 100644
--- a/client/src/assets/player/utils.ts
+++ b/client/src/assets/player/utils.ts
@@ -1,4 +1,3 @@
-import { escapeHTML } from '@shared/core-utils/renderer'
 import { VideoFile } from '@shared/models'
 
 function toTitleCase (str: string) {
@@ -44,14 +43,15 @@ function isMobile () {
 }
 
 function buildVideoOrPlaylistEmbed (embedUrl: string, embedTitle: string) {
-  const title = escapeHTML(embedTitle)
-
-  return '<iframe width="560" height="315" ' +
-    'sandbox="allow-same-origin allow-scripts allow-popups" ' +
-    'title="' + title + '" ' +
-    'src="' + embedUrl + '" ' +
-    'frameborder="0" allowfullscreen>' +
-    '</iframe>'
+  const iframe = document.createElement('iframe')
+
+  iframe.title = embedTitle
+  iframe.src = embedUrl
+  iframe.frameBorder = '0'
+  iframe.allowFullscreen = true
+  iframe.sandbox.add('allow-same-origin', 'allow-scripts', 'allow-popups')
+
+  return iframe.outerHTML
 }
 
 function videoFileMaxByResolution (files: VideoFile[]) {