From 7842d89d1a93b1c18fbd421ca83378c859aa229d Mon Sep 17 00:00:00 2001
From: Danh <nguyenhoaidanh2096@gmail.com>
Date: Wed, 25 Oct 2023 22:31:37 +0700
Subject: [PATCH] whitelist domain

---
 .../Announcement/Popups/CenterPopup.tsx       | 35 ++++++++++++-------
 1 file changed, 22 insertions(+), 13 deletions(-)

diff --git a/src/components/Announcement/Popups/CenterPopup.tsx b/src/components/Announcement/Popups/CenterPopup.tsx
index a88ef56e40..8e27a33378 100644
--- a/src/components/Announcement/Popups/CenterPopup.tsx
+++ b/src/components/Announcement/Popups/CenterPopup.tsx
@@ -113,19 +113,28 @@ const VideoWrapper = styled.div`
   height: ${VIDEO_SIZE};
 `
 
-const Video = ({ url, title }: { url: string; title: string }) => (
-  <VideoWrapper>
-    <iframe
-      width="100%"
-      height="100%"
-      src={url} // todo xss
-      frameBorder="0"
-      title={title}
-      allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture"
-      allowFullScreen
-    />
-  </VideoWrapper>
-)
+const whitelistDomains = ['drive.google.com', 'www.youtube.com']
+const Video = ({ url, title }: { url: string; title: string }) => {
+  try {
+    const { host } = new URL(url)
+    if (!whitelistDomains.includes(host)) return null
+  } catch (error) {
+    return null
+  }
+  return (
+    <VideoWrapper>
+      <iframe
+        width="100%"
+        height="100%"
+        src={url}
+        frameBorder="0"
+        title={title}
+        allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture"
+        allowFullScreen
+      />
+    </VideoWrapper>
+  )
+}
 
 export default function CenterPopup({
   onDismiss,