Clients get annoyed that we block this by default, but we don't want to open up un-necessary security holes

Would they still be annoyed when you explain to them it's a penetration vector, and they probably don't want that sort of risk? Then offer them a safer way of adding these widgets to their content? What that might be? Not sure.

Maybe you can use the object or embed tags instead of iframes. https://www.delftstack.com/howto/html/iframe-alternative/#:~:text=Use%20the%20object%20Tag%20as%20an%20Alternative%20to%20Iframe%20in%20HTML,-We%20can%20use&text=The%20object%20tag%20is%20an,the%20webpage%20to%20be%20embedded.

@Adam Cameron you are on the case as always! thanks! I thought you were going to tell me that it's all been resolved by the internet. I see people using iframes for all sorts of stuff like maps and video widgets. Apparently not.

reading further about embed tags and object tags, it appears that embed tags are deprecated.

@ryan yes, noticing that as well

but youtube definitely uses this stuff - iframes i think. so presumably that's a safe source and coule be whitelisted

I think iframes are still a security risk to cross-site attacks

I assume that if we leave the web editor open to accepting iframes, that would be a problem since someone on the client end could submit bad code to the db / site. But, if we could limit it to just, say, iframes from youtube or google maps, but block others, that might be a way to do it.

You probably can still use iframes, actually. New attributes were added to iframe last year. https://www.thoughtco.com/html5-attributes-iframe-element-3468668

very cool. i did not know that.

We use a shortcode to allow for user entry rather than cut and paste. i.e [youtube url = "foo"] and then can control how it's rendered. bit more fiddly for end user, but it also means you can update the embed code centrally, and control its output.

You could even add a button to the rich-txt editor to have a UI element to get the user's URL, and then insert the shortcode, yeah?

Oh sure; we actually use vueJS to render a preview serverside and add a custom widget etc, but the principle was more of providing an abstraction layer to the embed code whilst stored within RTE html

Sorry, I should have said "one" not "you" then.

@neokoenig So, you are saying that by using shortcodes and then having a specific whitelist of safe sources (e.g. you tube, google maps, etc.) you can basically filter out unknown embed or iframe sources that way?

I've pm'd you