From 5d90d1d03be94b5a6e2d5e4261ffb53b09de347c Mon Sep 17 00:00:00 2001
From: sec-check <280983584+hivecommons-hive[bot]@users.noreply.github.com>
Date: Sat, 31 Oct 2026 08:51:03 -0400
Subject: [PATCH] fix: sandbox the GitHub Universe talk player and gate its
 allowlist

The youtube-nocookie iframe is the only third-party frame on the site.
Restrict it to the sandbox tokens the embed needs (scripts, same-origin,
popups for 'Watch on YouTube', presentation for casting) so the frame
can no longer navigate the page, submit forms, open modals or start
downloads. featured-video.test.mjs now asserts the exact token set.

Closes #308

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: sec-check <280983584+hivecommons-hive[bot]@users.noreply.github.com>
---
 README.md                       |  2 +-
 index.html                      |  1 +
 scripts/featured-video.test.mjs | 13 +++++++++++++
 3 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 6155baf..f1f6659 100644
--- a/README.md
+++ b/README.md
@@ -56,7 +56,7 @@ red PR job against.
   resize debounce), and projects scroll-sync (debounced scroll, `scrollend`,
   IntersectionObserver). Zero dependencies.
 - `node --test scripts/featured-video.test.mjs` — checks the Bluefin talk's placement,
-  speaker attribution, privacy-enhanced lazy-loaded player, 6:09 start without autoplay,
+  speaker attribution, privacy-enhanced lazy-loaded sandboxed player, 6:09 start without autoplay,
   direct links to the highlighted and full talk, and the adopter link. Zero dependencies.
 - `node --test scripts/page-scripts.test.mjs` — static gate over every committed HTML
   page: each inline `<script>` parses, each JSON-LD block is valid schema.org JSON, no
diff --git a/index.html b/index.html
index 50aaf71..ea17f89 100644
--- a/index.html
+++ b/index.html
@@ -407,6 +407,7 @@ <h2 id="hive-in-practice-title">Hive in practice</h2>
         src="https://www.youtube-nocookie.com/embed/bUhCBYi4dys?start=369"
         title="Jorge Castro: What open source can teach us about agents in CI/CD"
         loading="lazy" referrerpolicy="strict-origin-when-cross-origin"
+        sandbox="allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox allow-presentation"
         allow="encrypted-media; picture-in-picture; fullscreen" allowfullscreen></iframe>
       <div class="talk-copy">
         <h3>How Project Bluefin uses Hive</h3>
diff --git a/scripts/featured-video.test.mjs b/scripts/featured-video.test.mjs
index d00874c..2e2578f 100644
--- a/scripts/featured-video.test.mjs
+++ b/scripts/featured-video.test.mjs
@@ -44,6 +44,19 @@ test("the privacy-enhanced player starts at the Hive discussion without autoplay
   assert.match(html, /frame-src https:\/\/www\.youtube-nocookie\.com;/);
 });
 
+test("the player is sandboxed to what the YouTube embed needs and cannot navigate the page", () => {
+  const frame = /<iframe\b[^>]*>/.exec(section)[0];
+  const sandbox = attribute(frame, "sandbox").split(/\s+/).filter(Boolean).sort();
+  assert.deepEqual(sandbox, [
+    "allow-popups",
+    "allow-popups-to-escape-sandbox",
+    "allow-presentation",
+    "allow-same-origin",
+    "allow-scripts",
+  ]);
+  for (const token of sandbox) assert.doesNotMatch(token, /^allow-(top-navigation|forms|modals|downloads)/);
+});
+
 test("direct YouTube links offer the highlighted discussion and full talk", () => {
   const links = [...section.matchAll(/<a\b[^>]*>[\s\S]*?<\/a>/g)];
   const discussion = links.find(([tag]) => tag.includes("Watch the Hive discussion"));