From aa1882fd99f130f207e6ee6bd4e520cfe1e044f1 Mon Sep 17 00:00:00 2001
From: Michael <heluecht@pirati.ca>
Date: Wed, 21 Nov 2018 07:07:24 +0000
Subject: [PATCH] Sanitize the OEmbed data before processing it

---
 src/Content/OEmbed.php |  3 +--
 src/Object/OEmbed.php  | 11 +++++++++++
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/src/Content/OEmbed.php b/src/Content/OEmbed.php
index c77db3827f..c37e36f607 100644
--- a/src/Content/OEmbed.php
+++ b/src/Content/OEmbed.php
@@ -247,8 +247,7 @@ class OEmbed
 
 		$ret .= '</div>';
 
-		$ret = str_replace("\n", "", $ret);
-		return mb_convert_encoding($ret, 'HTML-ENTITIES', mb_detect_encoding($ret));
+		return str_replace("\n", "", $ret);
 	}
 
 	public static function BBCode2HTML($text)
diff --git a/src/Object/OEmbed.php b/src/Object/OEmbed.php
index 20f27ae0bf..bd336f7583 100644
--- a/src/Object/OEmbed.php
+++ b/src/Object/OEmbed.php
@@ -42,6 +42,17 @@ class OEmbed
 		}
 
 		foreach ($properties as $key => $value) {
+			if (in_array($key, ['thumbnail_width', 'thumbnail_height', 'width', 'height'])) {
+				// These values should be numbers, so ensure that they really are numbers.
+				$value = (int)$value;
+			} elseif ($key != 'html') {
+				// Avoid being able to inject some ugly stuff through these fields.
+				$value = htmlentities($value);
+			} else {
+				/// @todo Add a way to sanitize the html as well, possibly with an <iframe>?
+				$value = mb_convert_encoding($value, 'HTML-ENTITIES', mb_detect_encoding($value));
+			}
+
 			if (property_exists(__CLASS__, $key)) {
 				$this->{$key} = $value;
 			}