Add html generation for photo type embed previews

[notnownikki]

No description provided.

[mkaz]

Looks good, works as expected 👍

[aduth]

One moment, I have a possible concern here I'd like some time to explore.

[aduth]

XSS is fun:

1. Navigate to Gutenberg
2. Insert Embed block
3. Insert as URL: http://i1070.photobucket.com/albums/u489/aduthie7/sad-baby_zpsnscz2ovs.jpeg
4. Click Embed
5. Get hacked (not really)

This is one benefit of using React elements over concatenating strings, as it takes care of escaping attribute values. Also why dangerouslySetInnerHTML is named as it is.

In this case, we must not allow user values (photo.title) to be inserted into the generated markup without proper escaping.

[notnownikki]

@aduth aha, I did try to find a service where that was a problem, but it looked like the embed API returned safe values. Thanks for finding one that didn't, will change things 😄

[notnownikki]

Ok, switched to JSX for the photo preview. I was under the impression that the embed API supplied clean values, but now I see it was actually cloudup sanitising things.

[aduth]

One-off sanitization scares me a bit. I'm looking at HtmlEmbed and wondering if we should be doing more sandboxing. I'm also curious to know if the oEmbed endpoint performs discovery, which would open up html to be injected by any properly-configured website.

[notnownikki]

Yes, we absolutely should be doing sandboxing, but it's difficult. On the initial version of this block, we agreed that we'd just inject the html into a div for now, so we could get the block working, and look at sandboxing once it was done.

I do not like the current implementation of HtmlEmbed, but the amount of work needed to get sandboxed iframes working correctly is not a small amount. Calypso has a resizing iframe, but it does not work by itself, there is more code needed to correctly calculate the height of embedded content for previews, and that code needs to be looked at and brought over into the HtmlEmbed component. It's not simple :( I'm looking at it though.

[notnownikki]

I opened #1348 to track the sandboxing issue.

[notnownikki]

Got the ok from @mtias to merge this, as long as we're working on the sandboxing.