Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -69,11 +69,14 @@ public String getURL() {

@Override
public String renderHTML(HttpServletRequest httpServletRequest) {

String src = _getSrcFromEmbedCode(
jsonObject.getString("html"));

return StringBundler.concat(
"<iframe allowfullscreen frameborder=\"0\" height=\"315\" ",
"mozallowfullscreen src=\"https://player.vimeo.com/video/",
vimeoVideoId, "\" webkitallowfullscreen ",
"width=\"560\"></iframe>");
"mozallowfullscreen src=\"", src,
"\" webkitallowfullscreen width=\"560\"></iframe>");
Comment on lines +73 to +79
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The _getSrcFromEmbedCode method can return an empty string if the regex fails to find a match in the HTML embed code from Vimeo. This would result in an <iframe> with an empty src attribute, causing a broken video embed. To make this more robust, you should add a fallback mechanism. If _getSrcFromEmbedCode returns a blank string, you can revert to the previous behavior of constructing the URL manually using vimeoVideoId. This ensures that a video is always displayed, even if parsing the embed code fails.

You will need to import com.liferay.portal.kernel.util.Validator.

                String src = _getSrcFromEmbedCode(
                    jsonObject.getString("html"));

                if (Validator.isBlank(src)) {
                    src = StringBundler.concat(
                        "https://player.vimeo.com/video/", vimeoVideoId);
                }

                return StringBundler.concat(
                    "<iframe allowfullscreen frameborder=\"0\" height=\"315\" ",
                    "mozallowfullscreen src=\"", src,
                    "\" webkitallowfullscreen width=\"560\"></iframe>");

}

};
Expand Down Expand Up @@ -110,6 +113,16 @@ private JSONObject _getEmbedJSONObject(String url) {
}
}

private String _getSrcFromEmbedCode(String html) {
Matcher matcher = _srcHtmlPattern.matcher(html);

if (matcher.find()) {
return matcher.group(1);
}

return StringPool.BLANK;
}

private String _getVimeoVideoId(String url) {
for (Pattern urlPattern : _urlPatterns) {
Matcher matcher = urlPattern.matcher(url);
Expand All @@ -125,6 +138,9 @@ private String _getVimeoVideoId(String url) {
private static final Log _log = LogFactoryUtil.getLog(
VimeoDLVideoExternalShortcutProvider.class);

private static final Pattern _srcHtmlPattern = Pattern.compile(
"src\\s*=\\s*\"([^\"]*)\"");
Comment on lines +141 to +142
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The current regex only matches src attributes with double quotes ("). While this might be sufficient for Vimeo's current API response, the HTML specification allows attributes to be enclosed in single quotes (') as well. To make the pattern more robust and future-proof, consider updating it to handle both single and double quotes.

	private static final Pattern _srcHtmlPattern = Pattern.compile(
		"src\\s*=\\s*[\"']([^\"']*)["']");


private static final List<Pattern> _urlPatterns = Arrays.asList(
Pattern.compile(
"https?:\\/\\/(?:www\\.)?vimeo\\.com\\/album\\/.*\\/video" +
Expand All @@ -146,4 +162,4 @@ private String _getVimeoVideoId(String url) {
@Reference
private JSONFactory _jsonFactory;

}
}