<commit_before>#mediaComment.coffee
define [
  'i18n!media_comments'
  'underscore'
  'vendor/jquery.ba-tinypubsub'
  'vendor/mediaelement-and-player'
  'jquery'
  'compiled/util/kalturaAnalytics'
], (I18n, _, pubsub, mejs, $, kalturaAnalytics) ->

  VIDEO_WIDTH = 550
  VIDEO_HEIGHT = 448
  $.extend mejs.MediaElementDefaults,
    # shows debug errors on screen
    # enablePluginDebug: false
    # path to Flash and Silverlight plugins
    pluginPath: '/images/mediaelement/'
    # default if the <video width> is not specified
    defaultVideoWidth: VIDEO_WIDTH
    # default if the <video height> is not specified
    defaultVideoHeight: VIDEO_HEIGHT

  unless INST.enableHtml5FirstVideos
    # prefer flash player, as it works more consistently
    # for now, but allow fallback to html5 (like on mobile)
    mejs.MepDefaults.mode = 'auto_plugin'

  mejs.MepDefaults.success = (mediaElement, domObject) ->
    kalturaAnalytics(this.mediaCommentId, mediaElement, INST.kalturaSettings)
    mediaElement.play()

  # track events in google analytics
  mejs.MepDefaults.features.push('googleanalytics')

  positionAfterSubtitleSelector = mejs.MepDefaults.features.indexOf('tracks') + 1

  # enable the source chooser
  mejs.MepDefaults.features.splice(positionAfterSubtitleSelector, 0, 'sourcechooser')

  # enable the playback speed selector
  mejs.MepDefaults.features.splice(positionAfterSubtitleSelector, 0, 'speed')


  getSourcesAndTracks = (id) ->
    dfd = new $.Deferred
    $.getJSON "/media_objects/#{id}/info", (data) ->
      # this 'when ...' is because right now in canvas, none of the mp3 urls actually work.
      # see: CNVS-12998
      sources = for source in data.media_sources when source.content_type isnt 'audio/mp3'
        "<source type='#{source.content_type}' src='#{source.url}' title='#{source.width}x#{source.height} #{Math.floor(source.bitrate / 1024)} kbps' />"

      tracks = _.map data.media_tracks, (track) ->
        languageName = mejs.language.codes[track.locale] || track.locale
        "<track kind='#{track.kind}' label='#{languageName}' src='#{track.url}' srclang='#{track.locale}' />"

      types = _.map data.media_sources, (source) -> source.content_type
      dfd.resolve {sources, tracks, types, can_add_captions: data.can_add_captions}
    dfd

  createMediaTag = ({sourcesAndTracks, mediaType, height, width, mediaPlayerOptions}) ->
    tagType = if mediaType is 'video' then 'video' else 'audio'
    st_tags = sourcesAndTracks.sources.concat(sourcesAndTracks.tracks).join('')

    getElement = (tagType) ->
      $("<#{tagType} #{if mediaType is 'video' then "width='#{width}' height='#{height}'" else ''} controls>#{st_tags}</#{tagType}>")
<commit_msg>fix media track/caption XSS vulnerability, fixes CNVS-17659<commit_after>#mediaComment.coffee
define [
  'i18n!media_comments'
  'underscore'
  'vendor/jquery.ba-tinypubsub'
  'vendor/mediaelement-and-player'
  'jquery'
  'compiled/util/kalturaAnalytics'
  'str/htmlEscape'
], (I18n, _, pubsub, mejs, $, kalturaAnalytics, htmlEscape) ->

  VIDEO_WIDTH = 550
  VIDEO_HEIGHT = 448
  $.extend mejs.MediaElementDefaults,
    # shows debug errors on screen
    # enablePluginDebug: false
    # path to Flash and Silverlight plugins
    pluginPath: '/images/mediaelement/'
    # default if the <video width> is not specified
    defaultVideoWidth: VIDEO_WIDTH
    # default if the <video height> is not specified
    defaultVideoHeight: VIDEO_HEIGHT

  unless INST.enableHtml5FirstVideos
    # prefer flash player, as it works more consistently
    # for now, but allow fallback to html5 (like on mobile)
    mejs.MepDefaults.mode = 'auto_plugin'

  mejs.MepDefaults.success = (mediaElement, domObject) ->
    kalturaAnalytics(this.mediaCommentId, mediaElement, INST.kalturaSettings)
    mediaElement.play()

  # track events in google analytics
  mejs.MepDefaults.features.push('googleanalytics')

  positionAfterSubtitleSelector = mejs.MepDefaults.features.indexOf('tracks') + 1

  # enable the source chooser
  mejs.MepDefaults.features.splice(positionAfterSubtitleSelector, 0, 'sourcechooser')

  # enable the playback speed selector
  mejs.MepDefaults.features.splice(positionAfterSubtitleSelector, 0, 'speed')


  getSourcesAndTracks = (id) ->
    dfd = new $.Deferred
    $.getJSON "/media_objects/#{id}/info", (data) ->
      # this 'when ...' is because right now in canvas, none of the mp3 urls actually work.
      # see: CNVS-12998
      sources = for source in data.media_sources when source.content_type isnt 'audio/mp3'
        "<source type='#{htmlEscape source.content_type}' src='#{htmlEscape source.url}' title='#{htmlEscape source.width}x#{htmlEscape source.height} #{htmlEscape(Math.floor(source.bitrate / 1024))} kbps' />"

      tracks = _.map data.media_tracks, (track) ->
        languageName = mejs.language.codes[track.locale] || track.locale
        "<track kind='#{htmlEscape track.kind}' label='#{htmlEscape languageName}' src='#{htmlEscape track.url}' srclang='#{htmlEscape track.locale}' />"

      types = _.map data.media_sources, (source) -> source.content_type
      dfd.resolve {sources, tracks, types, can_add_captions: data.can_add_captions}
    dfd

  createMediaTag = ({sourcesAndTracks, mediaType, height, width, mediaPlayerOptions}) ->
    tagType = if mediaType is 'video' then 'video' else 'audio'
    st_tags = sourcesAndTracks.sources.concat(sourcesAndTracks.tracks).join('')

    getElement = (tagType) ->
      html = "<#{tagType} #{if mediaType is 'video' then "width='#{width}' height='#{height}'" else ''} controls>#{st_tags}</#{tagType}>"
      $(html)

{'fraction_non_alphanumeric': 0.1256021409455843, 'fraction_numerical': 0.010169491525423728, 'mean_word_length': 4.1955514365152915, 'pattern_counts': {'":': 0, '<': 15, '<?xml version=': 0, '>': 31, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 4, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4813619', 'n_tokens_mistral': 1855, 'n_tokens_neox': 1768, 'n_words': 418}