CVE-2020-7642

@@ -27,6 +27,7 @@
 	var regId = /\{\{id}}/;
 	var regYtImg = /\{\{hqdefault}}/;
 	var regAmp = /^&/;
+	var regValidParam = /^[a-z0-9-_&=]+$/i;
 	var youtubeImg = protocol + '//img.youtube.com/vi/{{id}}/{{hqdefault}}.jpg';
 	var youtubeIframe = protocol + '//www.youtube.com/embed/{{id}}?autoplay=1';
 	var vimeoApi = protocol + '//vimeo.com/api/oembed.json?url=https%3A//vimeo.com/{{id}}';
@@ -64,6 +65,12 @@
 		var id = elem.getAttribute('data-vimeo');
 		var vimeoParams = elem.getAttribute('data-vimeoparams') || '';
 
+		elem.removeEventListener('click', embedVimeoIframe);
+
+		if (!id || !regValidParam.test(id) || (vimeoParams && !regValidParam.test(vimeoParams))) {
+			return;
+		}
+
 		if(vimeoParams && !regAmp.test(vimeoParams)){
 			vimeoParams = '&'+ vimeoParams;
 		}
@@ -74,7 +81,6 @@
 			'frameborder="0" allowfullscreen="" width="640" height="390"></iframe>'
 		;
 
-		elem.removeEventListener('click', embedVimeoIframe);
 	}
 
 	function embedYoutubeImg(id, elem){
@@ -89,6 +95,12 @@
 		var id = elem.getAttribute('data-youtube');
 		var youtubeParams = elem.getAttribute('data-ytparams') || '';
 
+		elem.removeEventListener('click', embedYoutubeIframe);
+
+		if (!id || !regValidParam.test(id) || (youtubeParams && !regValidParam.test(youtubeParams))) {
+			return;
+		}
+
 		if(youtubeParams && !regAmp.test(youtubeParams)){
 			youtubeParams = '&'+ youtubeParams;
 		}
@@ -98,8 +110,6 @@
 		elem.innerHTML = '<iframe src="' + (youtubeIframe.replace(regId, id)) + youtubeParams +'" ' +
 			'frameborder="0" allowfullscreen="" width="640" height="390"></iframe>'
 		;
-
-		elem.removeEventListener('click', embedYoutubeIframe);
 	}
 
 	document.addEventListener('lazybeforeunveil', function(e){

@@ -1,2 +1,2 @@
 /*! lazysizes - v5.2.0 */
-!function(a,b){if(a){var c=function(){b(a.lazySizes),a.removeEventListener("lazyunveilread",c,!0)};b=b.bind(null,a,a.document),"object"==typeof module&&module.exports?b(require("lazysizes")):a.lazySizes?c():a.addEventListener("lazyunveilread",c,!0)}}("undefined"!=typeof window?window:0,function(a,b,c){"use strict";function d(c,d){var e="vimeoCallback"+j,f=b.createElement("script");c+="&callback="+e,j++,a[e]=function(b){f.parentNode.removeChild(f),delete a[e],d(b)},f.src=c,b.head.appendChild(f)}function e(a,b){d(p.replace(k,a),function(a){a&&a.thumbnail_url&&(b.style.backgroundImage="url("+a.thumbnail_url+")")}),b.addEventListener("click",f)}function f(a){var b=a.currentTarget,c=b.getAttribute("data-vimeo"),d=b.getAttribute("data-vimeoparams")||"";d&&!m.test(d)&&(d="&"+d),a.preventDefault(),b.innerHTML='<iframe src="'+q.replace(k,c)+d+'" frameborder="0" allowfullscreen="" width="640" height="390"></iframe>',b.removeEventListener("click",f)}function g(a,b){var d=b.getAttribute("data-thumb-size")||c.cfg.ytThumb||"hqdefault";b.style.backgroundImage="url("+n.replace(k,a).replace(l,d)+")",b.addEventListener("click",h)}function h(a){var b=a.currentTarget,c=b.getAttribute("data-youtube"),d=b.getAttribute("data-ytparams")||"";d&&!m.test(d)&&(d="&"+d),a.preventDefault(),b.innerHTML='<iframe src="'+o.replace(k,c)+d+'" frameborder="0" allowfullscreen="" width="640" height="390"></iframe>',b.removeEventListener("click",h)}if(b.getElementsByClassName){var i="https:"==location.protocol?"https:":"http:",j=Date.now(),k=/\{\{id}}/,l=/\{\{hqdefault}}/,m=/^&/,n=i+"//img.youtube.com/vi/{{id}}/{{hqdefault}}.jpg",o=i+"//www.youtube.com/embed/{{id}}?autoplay=1",p=i+"//vimeo.com/api/oembed.json?url=https%3A//vimeo.com/{{id}}",q=i+"//player.vimeo.com/video/{{id}}?autoplay=1";b.addEventListener("lazybeforeunveil",function(a){if(a.detail.instance==c){var b=a.target,d=b.getAttribute("data-youtube"),f=b.getAttribute("data-vimeo");d&&b&&g(d,b),f&&b&&e(f,b)}})}});
\ No newline at end of file
+!function(a,b){if(a){var c=function(){b(a.lazySizes),a.removeEventListener("lazyunveilread",c,!0)};b=b.bind(null,a,a.document),"object"==typeof module&&module.exports?b(require("lazysizes")):a.lazySizes?c():a.addEventListener("lazyunveilread",c,!0)}}("undefined"!=typeof window?window:0,function(a,b,c){"use strict";function d(c,d){var e="vimeoCallback"+j,f=b.createElement("script");c+="&callback="+e,j++,a[e]=function(b){f.parentNode.removeChild(f),delete a[e],d(b)},f.src=c,b.head.appendChild(f)}function e(a,b){d(q.replace(k,a),function(a){a&&a.thumbnail_url&&(b.style.backgroundImage="url("+a.thumbnail_url+")")}),b.addEventListener("click",f)}function f(a){var b=a.currentTarget,c=b.getAttribute("data-vimeo"),d=b.getAttribute("data-vimeoparams")||"";b.removeEventListener("click",f),c&&n.test(c)&&(!d||n.test(d))&&(d&&!m.test(d)&&(d="&"+d),a.preventDefault(),b.innerHTML='<iframe src="'+r.replace(k,c)+d+'" frameborder="0" allowfullscreen="" width="640" height="390"></iframe>')}function g(a,b){var d=b.getAttribute("data-thumb-size")||c.cfg.ytThumb||"hqdefault";b.style.backgroundImage="url("+o.replace(k,a).replace(l,d)+")",b.addEventListener("click",h)}function h(a){var b=a.currentTarget,c=b.getAttribute("data-youtube"),d=b.getAttribute("data-ytparams")||"";b.removeEventListener("click",h),c&&n.test(c)&&(!d||n.test(d))&&(d&&!m.test(d)&&(d="&"+d),a.preventDefault(),b.innerHTML='<iframe src="'+p.replace(k,c)+d+'" frameborder="0" allowfullscreen="" width="640" height="390"></iframe>')}if(b.getElementsByClassName){var i="https:"==location.protocol?"https:":"http:",j=Date.now(),k=/\{\{id}}/,l=/\{\{hqdefault}}/,m=/^&/,n=/^[a-z0-9-_&=]+$/i,o=i+"//img.youtube.com/vi/{{id}}/{{hqdefault}}.jpg",p=i+"//www.youtube.com/embed/{{id}}?autoplay=1",q=i+"//vimeo.com/api/oembed.json?url=https%3A//vimeo.com/{{id}}",r=i+"//player.vimeo.com/video/{{id}}?autoplay=1";b.addEventListener("lazybeforeunveil",function(a){if(a.detail.instance==c){var b=a.target,d=b.getAttribute("data-youtube"),f=b.getAttribute("data-vimeo");d&&b&&g(d,b),f&&b&&e(f,b)}})}});
\ No newline at end of file