media_snippet
Security covered
The Media Snippet module provides a Drupal Media source for embedding self-contained websites or applications using iframes. It is designed to work with the iframe module and includes features like URL validation, thumbnail generation using a screenshot of the URL, and Content Security Policy (CSP) integration.
Features
- Media Source Plugin: Adds a "Snippet" media source that uses an iframe field.
- URL Validation: Validates source URLs against a configurable list of allowed patterns (with wildcard support) and checks for `X-Frame-Options` headers to ensure the content can be actually be embedded.
- Automated Thumbnails: Can automatically fetch and store screenshots of the target URL using the thum.io service.
- CSP Integration: Automatically updates Content Security Policy `frame-src` directives when the `csp` module is enabled, based on the allowed URLs configured for the media source.
- Media Library Support: Includes a custom add form for the Media Library to streamline the creation of snippet media items.
- Metadata Mapping: Supports mapping metadata like page title and HTML content from the source URL.
This media type can also be used to support any kind of iframe embeds such as the following providers, without needing additional modules:
- ArcGIS
- Google Calendar
- Google Forms
- Google Maps
- Microsoft Power BI
Post-Installation
- Go to Structure > Media types and add or edit a media type.
- Select Snippet as the Media source.
- In the source configuration, you can:
- Define a list of Allowed URLs (one per line, wildcards allowed)
- Enable Screenshot thumbnails via thum.io and specify the storage directory.
- Save the media type.