Enable Embedding GitHub Gists as Media in Posts

[emceeaich]

Title:
Enable Embedding GitHub Gists as Media in Posts

Area:
posting, media

Summary:
Enable adding GitHub Gists, which are embedded as scripts, in posts, via the 'add media' option so that DW users can post short blocks of formatted source code for discussion and review.

Description:
Gists are text files hosted on GitHub enabling developers to post short snippets of code for review and comment.

GitHub provides a way to embed a gist on a site, as a script file:

<script src="https://gist.github.com/3290622.js?file=foo.js"></script>

However, DW wisely prevents scripts from being embedded as either media or post content because XSS :)

But adding gist.github.com to a whitelist would enable coders of all skill levels to quickly post nicely formatted snippets of code for review, discussion, and comment.

Poll #11553 Enable Embedding GitHub Gists as Media in Posts

Open to: Registered Users, detailed results viewable to: All, participants: 53

View Respondents

This suggestion:

View Answers

Should be implemented as-is.
13 (24.5%)

Should be implemented with changes. (please comment)
5 (9.4%)

Shouldn't be implemented.
5 (9.4%)

(I have no opinion)
30 (56.6%)

(Other: please comment)
0 (0.0%)

Comments

[emceeaich]

That is not what I said.

What I said, is that if there was a flaw in GitHub's code that propagated a XSS or CSRF, then we would have an exposure.

That is not the same as allowing arbitrary scripts which could be intentionally written with a XSS or CSRF vector.

[swaldman]

Ah, I misunderstood. The Github user can't write the script, the script is simply something generated by github to display the user's text? So that's no worse than being at risk from bugs in other sites such as Youtube?
*changes vote*

[emceeaich]

Yes. Embedding a flash control such as YouTube's means that we're trusting both the flash component and actionscript in the control.

And I would like to have an audit of GitHub's Gist embedding implimentation before proceeding. A review can be a go/no-go part of the process.

[ninetydegrees]

Thanks for the clarification; I'm back to my first comment then. :)