Merge branch 'ISAICP-7278' into 'master'

ISAICP-7278: Additional checks on internal path videos

See merge request !52

web/modules/custom/joinup_video/src/Plugin/video_embed_field/Provider/InternalPath.php

@@ -22,16 +22,18 @@ class InternalPath extends ProviderPluginBase {
    * {@inheritdoc}
    */
   public function renderEmbedCode($width, $height, $autoplay) {
-    $iframe = [
+    $path = $this->getVideoId();
+    if (UrlHelper::isExternal($path)) {
+      return [];
+    }
+    return [
       '#type' => 'video_embed_iframe',
       '#provider' => 'internal_path',
-      '#url' => Url::fromUri('internal:/' . $this->getVideoId())
+      '#url' => Url::fromUri("internal:/$path")
         ->setOption('base_url', $GLOBALS['base_url'])
         ->setAbsolute()
         ->toString(),
     ];
-
-    return $iframe;
   }
 
   /**

web/modules/custom/joinup_video/tests/src/ExistingSite/InternalPathTest.php

+<?php
+
+declare(strict_types = 1);
+
+namespace Drupal\Tests\joinup_video\ExistingSite;
+
+use Drupal\Tests\joinup_test\ExistingSite\JoinupExistingSiteTestBase;
+use Drupal\Tests\rdf_entity\Traits\DrupalTestTraits\RdfEntityCreationTrait;
+
+/**
+ * Regression test for ISAICP-7278.
+ *
+ * @see https://citnet.tech.ec.europa.eu/CITnet/jira/browse/ISAICP-7278
+ *
+ * @group joinup_video
+ */
+class InternalPathTest extends JoinupExistingSiteTestBase {
+
+  use RdfEntityCreationTrait;
+
+  /**
+   * @covers \Drupal\joinup_video\Plugin\video_embed_field\Provider\InternalPath::renderEmbedCode
+   */
+  public function testInternalPathVideo(): void {
+    $base_url = $GLOBALS['base_url'] . '/';
+    $collection = $this->createRdfEntity([
+      'rid' => 'collection',
+      'label' => "Sample Collection ",
+      'field_ar_state' => 'validated',
+      'field_ar_description' => [
+        // Covering the case when the base URL has been entered twice.
+        'value' => ' <iframe src="' . $base_url . $base_url . '" width="640" height="360" frameborder="0" webkitallowfullscreen mozallowfullscreen allowfullscreen></iframe>',
+        'format' => 'content_editor',
+      ],
+    ]);
+    $this->drupalGet($collection->toUrl('about-page'));
+    $this->assertSession()->pageTextContains('Sample Collection');
+    // No iframe has been rendered.
+    $this->assertSession()->responseNotContains('<iframe');
+  }
+
+}