Exact

Exact Union RegExp

Isaac Janzen bdacc74ab3 SECURITY: validate oEmbed provider_name against URL host in generic Onebox (#42217) ... ## Summary An attacker-controlled oEmbed response could claim to be Flickr or Meetup and make the generic Onebox engine persist its supplied HTML. The fix validates that the oEmbed response's provider_name matches the host of the original onebox URL before granting the raw-HTML passthrough path. ## Source - Patch Triage: https://patch.discourse.org/patch-triage/1571 Co-authored-by: discourse-patch-triage <272280883+discourse-patch-triage[bot]@users.noreply.github.com>		2026-07-31 10:47:03 -05:00
..
allowlisted_generic_onebox.rb	SECURITY: validate oEmbed provider_name against URL host in generic Onebox (#42217)	2026-07-31 10:47:03 -05:00
amazon_onebox.rb	DEV: Enable Style/RedundantParentheses rubocop rule (#40095)	2026-05-19 15:48:09 +02:00
animated_image_onebox.rb
asciinema_onebox.rb
audio_com_onebox.rb
audio_onebox.rb
audioboom_onebox.rb
band_camp_onebox.rb
cloud_app_onebox.rb
coub_onebox.rb
discourse_topic_onebox.rb
facebook_media_onebox.rb
five_hundred_px_onebox.rb
flickr_onebox.rb
flickr_shortened_onebox.rb
gfycat_onebox.rb
github_actions_onebox.rb	FEATURE: Route all GitHub API requests through one rate-limited client (#40637)	2026-06-15 10:59:10 +02:00
github_blob_onebox.rb	FEATURE: Route all GitHub API requests through one rate-limited client (#40637)	2026-06-15 10:59:10 +02:00
github_commit_onebox.rb	FEATURE: Route all GitHub API requests through one rate-limited client (#40637)	2026-06-15 10:59:10 +02:00
github_folder_onebox.rb	FIX: Better handling of github_folder onebox w/o opengraph tags (#39142)	2026-04-08 11:49:57 +02:00
github_gist_onebox.rb	FEATURE: Route all GitHub API requests through one rate-limited client (#40637)	2026-06-15 10:59:10 +02:00
github_issue_onebox.rb	FEATURE: Route all GitHub API requests through one rate-limited client (#40637)	2026-06-15 10:59:10 +02:00
github_pull_request_onebox.rb	FEATURE: Route all GitHub API requests through one rate-limited client (#40637)	2026-06-15 10:59:10 +02:00
github_repo_onebox.rb	FEATURE: Route all GitHub API requests through one rate-limited client (#40637)	2026-06-15 10:59:10 +02:00
gitlab_blob_onebox.rb
google_calendar_onebox.rb
google_docs_onebox.rb
google_drive_onebox.rb
google_maps_onebox.rb	DEV: Enable Style/RedundantBegin rubocop rule (#40096)	2026-05-19 18:44:54 +02:00
google_meet_onebox.rb	FEATURE: add Google Meet oneboxes (#41018)	2026-06-18 15:49:43 +10:00
google_photos_onebox.rb
google_play_app_onebox.rb
hackernews_onebox.rb
html.rb
image_onebox.rb	FIX: Support Dropbox /scl/ URL format in video and image oneboxes (#38394)	2026-03-11 10:37:57 +01:00
imgur_onebox.rb
instagram_onebox.rb
json.rb
kaltura_onebox.rb
loom_onebox.rb
mixcloud_onebox.rb
motoko_onebox.rb
opengraph_image.rb
pastebin_onebox.rb
pdf_onebox.rb
pubmed_onebox.rb	DEV: Enable Style/RedundantParentheses rubocop rule (#40095)	2026-05-19 15:48:09 +02:00
reddit_media_onebox.rb	FEATURE: Native Reddit embeds for oneboxes (#39162)	2026-04-09 11:56:22 -03:00
replit_onebox.rb
simplecast_onebox.rb
sketch_fab_onebox.rb
slides_onebox.rb
sound_cloud_onebox.rb
spotify_onebox.rb
stack_exchange_onebox.rb
standard_embed.rb	DEV: Enable Style/RedundantParentheses rubocop rule (#40095)	2026-05-19 15:48:09 +02:00
steam_store_onebox.rb
threads_status_onebox.rb
tiktok_onebox.rb
trello_onebox.rb
twitch_clips_onebox.rb
twitch_stream_onebox.rb
twitch_video_onebox.rb
twitter_status_onebox.rb	FIX: Respect blocked_onebox_domains for Twitter/X and handle empty oneboxes (#38868)	2026-03-25 15:10:35 +01:00
typeform_onebox.rb
video_onebox.rb	FIX: Support Dropbox /scl/ URL format in video and image oneboxes (#38394)	2026-03-11 10:37:57 +01:00
vimeo_onebox.rb
wikimedia_onebox.rb
wikipedia_onebox.rb	DEV: Enable Style/RedundantParentheses rubocop rule (#40095)	2026-05-19 15:48:09 +02:00
wistia_onebox.rb
xkcd_onebox.rb
youku_onebox.rb
youtube_onebox.rb	FIX: Use oEmbed for YouTube oneboxing (#35959)	2025-11-12 14:13:16 +10:00