Skip to content

Fixed Twitter/X embeds#2022

Merged
sagzy merged 2 commits into
mainfrom
agent/fix-x-embeds
Jul 21, 2026
Merged

Fixed Twitter/X embeds#2022
sagzy merged 2 commits into
mainfrom
agent/fix-x-embeds

Conversation

@sagzy

@sagzy sagzy commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

With the Twitter → X rebrand, the Twitter widget moved from being hosted on platform.twitter.com to new being hosted on platform.x.com.

With this change, both legacy and new URLs are supported as widget hosts. Also cleaned up the unnecessary allowedScriptDomains: ['twitter.com'].

no issue

X now serves generated embed widgets from platform.x.com, which the HTML sanitizer removed because only legacy Twitter script hosts were allowed. Permit the exact X widget hostname while retaining legacy Twitter support and avoiding a broader x.com subdomain allowlist.
@coderabbitai

coderabbitai Bot commented Jul 21, 2026

Copy link
Copy Markdown

Review Change Stack

Walkthrough

The HTML sanitizer now allowlists scripts from platform.twitter.com and platform.x.com, replacing the previous script-domain option. The related unit test adds Twitter and X script tags alongside a disallowed script and verifies that only the allowed scripts and paragraph content remain after sanitization.

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Title check ✅ Passed The title clearly matches the main change: updating Twitter/X embed support.
Description check ✅ Passed The description accurately describes the host migration and allowlist cleanup in the changeset.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch agent/fix-x-embeds

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@sagzy sagzy changed the title 🐛 Fixed X embed script sanitization Fixed Twitter/X embeds Jul 21, 2026
no issue

The legacy and current embed widgets are covered by exact hostname entries. Keeping the domain-wide permission would unnecessarily allow executable scripts from every twitter.com subdomain.
@sagzy
sagzy marked this pull request as ready for review July 21, 2026 08:28
@sagzy
sagzy merged commit 9f9bea7 into main Jul 21, 2026
15 checks passed
@sagzy
sagzy deleted the agent/fix-x-embeds branch July 21, 2026 08:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant