Merge pull request #1327 from noesya/better-video-csp-domains

Amélioration des politiques de sécurité liées aux vidéos

app/models/communication/website/with_security.rb

@@ -34,7 +34,7 @@ module Communication::Website::WithSecurity
     blocks.where(template_kind: :video).each do |block|
       video_url = block.template.url
       next unless video_url.present?
-      list << Video::Provider.find(video_url).csp_domain
+      list.concat Video::Provider.find(video_url).csp_domains
     end
     list
   end

app/services/video/provider/dailymotion.rb

 class Video::Provider::Dailymotion < Video::Provider::Default
-  DOMAINS = ['dailymotion.com', 'dai.ly']
+  DOMAINS = [
+    'dailymotion.com', 
+    'dai.ly'
+  ]
 
   def identifier
     video_url.include?('dai.ly')  ? video_url.split('dai.ly/').last
                                   : video_url.split('video/').last
   end
 
+  def csp_domains
+    DOMAINS
+  end
+
   # https://www.dailymotion.com/thumbnail/video/x8lyp39
   def poster
     "https://www.dailymotion.com/thumbnail/video/#{identifier}"

app/services/video/provider/default.rb

@@ -17,14 +17,18 @@ class Video::Provider::Default
     video_url
   end
 
-  def csp_domain
-    URI.parse(iframe_url).host
+  def csp_domains
+    [host]
   end
 
   def identifier
     ''
   end
 
+  def host
+    URI.parse(iframe_url).host
+  end
+
   def poster
     ''
   end

app/services/video/provider/peertube.rb

 class Video::Provider::Peertube < Video::Provider::Default
-  DOMAINS = ['peertube.fr']
+  DOMAINS = [
+    'peertube.fr'
+  ]
 
   def identifier
     video_url.split('/w/').last

app/services/video/provider/vimeo.rb

 class Video::Provider::Vimeo < Video::Provider::Default
-  DOMAINS = ['vimeo.com']
+  DOMAINS = [
+    'vimeo.com',
+    'player.vimeo.com',
+    'vumbnail.com'
+  ]
 
   def identifier
     video_url.chomp('/').split('/').last
   end
 
+  def csp_domains
+    DOMAINS
+  end
+
   # https://vumbnail.com/621585396.jpg
   def poster
     "https://vumbnail.com/#{identifier}.jpg"

app/services/video/provider/youtube.rb

 class Video::Provider::Youtube < Video::Provider::Default
-  DOMAINS = ['youtube.com', 'youtu.be']
+  DOMAINS = [
+    'youtube.com', 
+    'www.youtube.com', 
+    'img.youtube.com', 
+    'youtu.be', 
+  ]
 
   def identifier
     video_url.include?('youtu.be')  ? video_url.split('youtu.be/').last
                                     : video_url.split('v=').last
   end
 
+  def csp_domains
+    DOMAINS
+  end
+
   # https://img.youtube.com/vi/XEEUOiTgJL0/hqdefault.jpg
   def poster
     "https://img.youtube.com/vi/#{identifier}/hqdefault.jpg"