🐛 fix: sandbox the GitHub Universe talk player and gate its allowlist

README.md

@@ -56,7 +56,7 @@ red PR job against.
   resize debounce), and projects scroll-sync (debounced scroll, `scrollend`,
   IntersectionObserver). Zero dependencies.
 - `node --test scripts/featured-video.test.mjs` — checks the Bluefin talk's placement,
-  speaker attribution, privacy-enhanced lazy-loaded player, 6:09 start without autoplay,
+  speaker attribution, privacy-enhanced lazy-loaded sandboxed player, 6:09 start without autoplay,
   direct links to the highlighted and full talk, and the adopter link. Zero dependencies.
 - `node --test scripts/page-scripts.test.mjs` — static gate over every committed HTML
   page: each inline `<script>` parses, each JSON-LD block is valid schema.org JSON, no

index.html

@@ -407,6 +407,7 @@ <h2 id="hive-in-practice-title">Hive in practice</h2>
         src="https://www.youtube-nocookie.com/embed/bUhCBYi4dys?start=369"
         title="Jorge Castro: What open source can teach us about agents in CI/CD"
         loading="lazy" referrerpolicy="strict-origin-when-cross-origin"
+        sandbox="allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox allow-presentation"
         allow="encrypted-media; picture-in-picture; fullscreen" allowfullscreen></iframe>
       <div class="talk-copy">
         <h3>How Project Bluefin uses Hive</h3>

scripts/featured-video.test.mjs

@@ -44,6 +44,19 @@ test("the privacy-enhanced player starts at the Hive discussion without autoplay
   assert.match(html, /frame-src https:\/\/www\.youtube-nocookie\.com;/);
 });
 
+test("the player is sandboxed to what the YouTube embed needs and cannot navigate the page", () => {
+  const frame = /<iframe\b[^>]*>/.exec(section)[0];
+  const sandbox = attribute(frame, "sandbox").split(/\s+/).filter(Boolean).sort();
+  assert.deepEqual(sandbox, [
+    "allow-popups",
+    "allow-popups-to-escape-sandbox",
+    "allow-presentation",
+    "allow-same-origin",
+    "allow-scripts",
+  ]);
+  for (const token of sandbox) assert.doesNotMatch(token, /^allow-(top-navigation|forms|modals|downloads)/);
+});
+
 test("direct YouTube links offer the highlighted discussion and full talk", () => {
   const links = [...section.matchAll(/<a\b[^>]*>[\s\S]*?<\/a>/g)];
   const discussion = links.find(([tag]) => tag.includes("Watch the Hive discussion"));