From 7d7c6712f952dca2223149a5519e73b93189fab3 Mon Sep 17 00:00:00 2001 From: ccd0 Date: Sat, 9 Aug 2014 09:08:45 -0700 Subject: [PATCH] gist embedding: replace purplegene with sandboxed iframe with data: URI which will work on HTTPS --- src/Linkification/Linkify.coffee | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/Linkification/Linkify.coffee b/src/Linkification/Linkify.coffee index 36db98d3b..c1d5411c4 100755 --- a/src/Linkification/Linkify.coffee +++ b/src/Linkification/Linkify.coffee @@ -238,9 +238,11 @@ Linkify = key: 'gist' regExp: /.*(?:gist.github.com.*\/)([^\/][^\/]*)$/ el: (a) -> - $.el 'iframe', - # Github doesn't allow embedding straight from the site, so we use an external site to bypass that. - src: "http://www.purplegene.com/script?url=https://gist.github.com/#{a.dataset.uid}.js" + el = $.el 'iframe' + el.setAttribute 'sandbox', 'allow-scripts' + content = <%= html('${a.dataset.uid}') %> + el.src = "data:text/html;charset=utf-8,#{encodeURIComponent content.innerHTML}" + el title: api: (uid) -> "https://api.github.com/gists/#{uid}" text: ({files}) ->