claude-codex r3 (cont): guard installer in social-videos partial, TikTok iframe v1 path, cap embedAll at 12 — adversarial probe shows evilyoutube.com now rejected

350a7bb51ab87a7d618821c95f026331508b7892 · 2026-05-06 11:35:10 -0700 · Steve

Files touched

M lib/social-embed.js
M views/partials/social-videos.ejs

Diff

commit 350a7bb51ab87a7d618821c95f026331508b7892
Author: Steve <steve@designerwallcoverings.com>
Date:   Wed May 6 11:35:10 2026 -0700

    claude-codex r3 (cont): guard installer in social-videos partial, TikTok iframe v1 path, cap embedAll at 12 — adversarial probe shows evilyoutube.com now rejected
---
 lib/social-embed.js              | 8 +++++---
 views/partials/social-videos.ejs | 5 ++++-
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/lib/social-embed.js b/lib/social-embed.js
index d416539..bab98e3 100644
--- a/lib/social-embed.js
+++ b/lib/social-embed.js
@@ -94,8 +94,8 @@ function embed(input) {
     return {
       platform: 'tiktok',
       url,
-      embedUrl: `https://www.tiktok.com/embed/v2/${tt}`,
-      html: `<iframe class="social-embed tt" src="https://www.tiktok.com/embed/v2/${tt}" title="${escapeHtml(title) || 'TikTok'}" loading="lazy" allow="encrypted-media" allowfullscreen referrerpolicy="strict-origin-when-cross-origin"></iframe>`
+      embedUrl: `https://www.tiktok.com/player/v1/${tt}`,
+      html: `<iframe class="social-embed tt" src="https://www.tiktok.com/player/v1/${tt}" title="${escapeHtml(title) || 'TikTok'}" loading="lazy" allow="encrypted-media" allowfullscreen referrerpolicy="strict-origin-when-cross-origin"></iframe>`
     };
   }
 
@@ -118,7 +118,9 @@ function embedAll(arrayOrJsonb) {
     try { arr = JSON.parse(arr); } catch { arr = []; }
   }
   if (!Array.isArray(arr)) return [];
-  return arr.map(embed).filter(Boolean);
+  // Cap to 12 — protects against a hostile/buggy admin payload rendering
+  // dozens of iframes inline. (claude-codex r3 finding MEDIUM#8)
+  return arr.slice(0, 12).map(embed).filter(Boolean);
 }
 
 module.exports = { embed, embedAll };
diff --git a/views/partials/social-videos.ejs b/views/partials/social-videos.ejs
index 9082b85..e6770c5 100644
--- a/views/partials/social-videos.ejs
+++ b/views/partials/social-videos.ejs
@@ -3,7 +3,10 @@
   // installer.ejs + 6 installer-tpl-*.ejs). Renders nothing when there's
   // no embed-able URL and no IG/YT/TikTok handle.
   var _hasEmbed = (typeof featuredVideos !== 'undefined' && Array.isArray(featuredVideos) && featuredVideos.length > 0);
-  var _hasHandle = installer && (installer.youtube_handle || installer.instagram_handle || installer.tiktok_handle);
+  // typeof guard: every installer template currently passes installer, but a
+  // future error/fallback render path could omit it. Match the featuredVideos
+  // pattern. (claude-codex r3 finding HIGH#5)
+  var _hasHandle = (typeof installer !== 'undefined') && installer && (installer.youtube_handle || installer.instagram_handle || installer.tiktok_handle);
 %>
 <% if (_hasEmbed || _hasHandle) { %>
 <section class="profile-videos" aria-labelledby="videos-heading">

← 4ecde9c claude-codex r3: fix null-element crash in 4 templates, sess · back to NationalPaperHangers · watch page: ops-curated YT videos about pro installations + a7e5ecf →