From b687b52dffdb96ce5b48edc62a95a5c4ca1c9e1d Mon Sep 17 00:00:00 2001 From: rejaad Date: Sun, 31 May 2026 23:09:47 -0500 Subject: [PATCH 1/4] Fix YouTube embeds failing with Error 153 in the desktop app YouTube /embed iframes in project descriptions fail to play inside the Tauri desktop app with "Video player configuration error" (Error 153), while working fine on the website. The cause is the app's document origin (tauri://localhost) which YouTube's embedded player rejects. Inject origin=https://modrinth.com into allowed YouTube embed URLs in the shared markdown sanitizer so the player receives a valid web origin. This is applied in the same code path used by both the website and the app, and is a no-op on the website (already served from modrinth.com). Also allow the referrerpolicy attribute on iframes. Co-Authored-By: Claude Opus 4.8 --- packages/utils/parse.ts | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/packages/utils/parse.ts b/packages/utils/parse.ts index 4d15153912..46c36b1607 100644 --- a/packages/utils/parse.ts +++ b/packages/utils/parse.ts @@ -16,7 +16,7 @@ export const configuredXss = new FilterXSS({ h6: ['id'], kbd: ['id'], input: ['checked', 'disabled', 'type'], - iframe: ['width', 'height', 'allowfullscreen', 'frameborder', 'start', 'end'], + iframe: ['width', 'height', 'allowfullscreen', 'frameborder', 'start', 'end', 'referrerpolicy'], img: [...(whiteList.img || []), 'usemap', 'style', 'align'], map: ['name'], area: [...(whiteList.a || []), 'coords'], @@ -38,10 +38,18 @@ export const configuredXss = new FilterXSS({ onIgnoreTagAttr: (tag, name, value) => { // Allow iframes from acceptable sources if (tag === 'iframe' && name === 'src') { - const allowedSources = [ + const allowedSources: { + url: RegExp + allowedParameters: RegExp[] + forcedParameters?: Record + }[] = [ { url: /^https?:\/\/(www\.)?youtube(-nocookie)?\.com\/embed\/[a-zA-Z0-9_-]{11}/, allowedParameters: [/start=\d+/, /end=\d+/], + // Force a valid web origin so embeds work inside the Tauri webview, + // whose document origin (tauri://localhost) YouTube otherwise rejects + // with "Video player configuration error" (Error 153). + forcedParameters: { origin: 'https://modrinth.com' }, }, { url: /^https?:\/\/(www\.)?discord\.com\/widget/, @@ -64,6 +72,12 @@ export const configuredXss = new FilterXSS({ } }) + if (source.forcedParameters) { + for (const [key, paramValue] of Object.entries(source.forcedParameters)) { + newSearchParams.set(key, paramValue) + } + } + url.search = newSearchParams.toString() return `${name}="${escapeAttrValue(url.toString())}"` } From b0c909c25200091d2ccfd9ff2dc07085f6f332ff Mon Sep 17 00:00:00 2001 From: rejaad Date: Mon, 1 Jun 2026 12:38:59 -0500 Subject: [PATCH 2/4] Force origin + referrerpolicy on YouTube embeds in markdown First attempt at fixing YouTube embeds failing with Error 153 in the desktop app: inject origin=https://modrinth.com into allowed YouTube embed URLs and add referrerpolicy="unsafe-url" to the iframe via the shared markdown sanitizer. This alone does not fix macOS: WKWebView refuses to send any Referer for a cross-origin subframe when the parent document loads from the custom tauri://localhost scheme, regardless of referrerpolicy. Kept because it is harmless on the website and correct for platforms that do send a referrer. The working macOS fix follows in later commits. Co-Authored-By: Claude Opus 4.8 --- packages/utils/highlightjs/index.ts | 28 +++++++++++++++------------- packages/utils/parse.ts | 17 ++++++++++++++++- 2 files changed, 31 insertions(+), 14 deletions(-) diff --git a/packages/utils/highlightjs/index.ts b/packages/utils/highlightjs/index.ts index dbfbae0892..5e3e2c7d00 100644 --- a/packages/utils/highlightjs/index.ts +++ b/packages/utils/highlightjs/index.ts @@ -17,7 +17,7 @@ import xml from 'highlight.js/lib/languages/xml' import yaml from 'highlight.js/lib/languages/yaml' import mcfunction from 'highlightjs-mcfunction' -import { configuredXss, md } from '../parse' +import { configuredXss, injectEmbedReferrerPolicy, md } from '../parse' import skript from './skript' /* REGISTRATION */ @@ -58,20 +58,22 @@ hljs.registerAliases(['html', 'htm', 'xhtml', 'mcui', 'fxml'], { languageName: ' export { hljs } export const renderHighlightedString = (string) => - configuredXss.process( - md({ - highlight(str, lang) { - if (lang && hljs.getLanguage(lang)) { - try { - return hljs.highlight(str, { language: lang }).value - } catch { - /* empty */ + injectEmbedReferrerPolicy( + configuredXss.process( + md({ + highlight(str, lang) { + if (lang && hljs.getLanguage(lang)) { + try { + return hljs.highlight(str, { language: lang }).value + } catch { + /* empty */ + } } - } - return '' - }, - }).render(string), + return '' + }, + }).render(string), + ), ) export const highlightCodeLines = (code: string, language: string): string[] => { diff --git a/packages/utils/parse.ts b/packages/utils/parse.ts index 46c36b1607..3f1094c4a1 100644 --- a/packages/utils/parse.ts +++ b/packages/utils/parse.ts @@ -199,4 +199,19 @@ export const md = (options = {}) => { return md } -export const renderString = (string: string) => configuredXss.process(md().render(string)) +// WKWebView (macOS) loads the app from a custom `tauri://localhost` scheme and +// will not attach a Referer to cross-origin subframes, which makes YouTube embeds +// fail with "Video player configuration error" (Error 153). Forcing +// `referrerpolicy="unsafe-url"` asks the engine to send the fullest referrer it +// can, which YouTube accepts. Applied after sanitization so it only touches +// iframes the allow-list already validated. +export const injectEmbedReferrerPolicy = (html: string) => + html.replace(/]*\breferrerpolicy=)([^>]*?)>/gi, (match, attrs) => { + if (!/\bsrc=["'][^"']*youtube(-nocookie)?\.com\/embed\//i.test(attrs)) { + return match + } + return `