fix(security): strip video embeds from rich text linkification

components/utils/index.js

@@ -687,6 +687,8 @@ export const updateLinks = (input) => {
     const EMPTY_QUILL_PARAGRAPHS_REGEX =
         /<p[^>]*>\s*(?:<br\s*\/?>|&nbsp;|\s)*\s*<\/p>/gi;
 
+    const VIDEO_EMBED_REGEX = /<(iframe|video)\b[^>]*>[\s\S]*?<\/\1\s*>/gi;
+
     const URL_REGEX = /\b(https?:\/\/[^\s<]+)/gi;
 
     const stripTrailingUrlPunctuation = (url) => {
@@ -732,7 +734,9 @@ export const updateLinks = (input) => {
     const processHtmlString = (htmlString) => {
         if (typeof htmlString !== "string" || !htmlString) return htmlString;
 
-        let html = htmlString.replace(EMPTY_QUILL_PARAGRAPHS_REGEX, "");
+        let html = htmlString
+            .replace(VIDEO_EMBED_REGEX, "")
+            .replace(EMPTY_QUILL_PARAGRAPHS_REGEX, "");
 
         const anchorPlaceholders = [];
         html = html.replace(/<a\b[^>]*>[\s\S]*?<\/a>/gi, (match) => {