<iframe> embeds in Markdown content

Support embedding <iframes> in GitLab Flavored Markdown, enabling rich content embeds from services like YouTube, Figma, and others.

Done

• Ability to configure permitting iframe embeds in Markdown on an instance level, with an allowlist approach for domains permitted inside such an iframe.
• Embed via ![](url) syntax, where url is the iframe source.
• Allow applying width/height parameters as these embeds by default are unhelpfully small — Pass iframe dimensions through if supplied (!224624 - merged) • Asherah Connor • 18.10
• Refactor to support future work — Avoid iframes having to deal with asset proxy/l... (!224625 - merged) • Asherah Connor • 18.11
• Support transforming <iframe> as written or copy-pasted in so we can take embed code from YouTube or Figma — Treat `<iframe>` as `<img>` (!224626 - merged) • Asherah Connor • 18.11
• Support default URL transformations for YouTube/Figma, so e.g. embedding a YouTube "view" URL also Just Works™ (DWIM principle) — Transform `<iframe>` URLs according to a registry (!223870 - merged) • Asherah Connor • 19.0
• Refactor of RTE resizable embedded content — Refactor media resize into shared mixin and fix... (!231411 - merged) • Asherah Connor • 19.0
• Rich-text editor support for <iframe> embeds — Support iframe embeds in rich-text editor (!231412 - merged) • Asherah Connor • 19.0

To-do for GA

• Allow YouTube embeds to be opened in new windows — !231827
• Rework per discussion had with AppSec review — Rework <iframe> embed configuration (#599713 - closed) • Asherah Connor • 19.6
  • Add `<iframe>` provider model and parser (!254943 - merged) • Asherah Connor • 19.5
  • Add `<iframe>` provider loader and base config (!254944 - merged) • Asherah Connor • 19.5
  • Convert `<iframe>` allowlist setting to provide... (!254945 - merged) • Asherah Connor • 19.5
  • Move to `<iframe>` providers (!254946 - merged) • Asherah Connor • 19.5
  • Remove dead `<iframe>` transform code (!254947 - merged) • Asherah Connor • 19.5
  • Allow additional CSP hosts in `<iframe>` embeds (!257463 - merged) • Asherah Connor • 19.5
  • Reject sneaky dot segments in `<iframe>` URLs (!258894 - merged) • Asherah Connor • 19.6
  • Frontend `<iframe>` hardening (!254948 - merged) • Asherah Connor • 19.5
  • Render `<iframe>` embeds in Vue (!259513 - merged) • Asherah Connor • 19.6
  • Click-to-activate functionality for `<iframe>`s (!254949 - merged) • Asherah Connor • 19.5
  • Admin UI for `<iframe>` providers (!254950 - merged) • Asherah Connor • 19.5
  • Replace `<iframe>` candidate `<img>`s with iner... (!261387 - merged) • Asherah Connor • 19.6
  • Mark `<iframe>` config, loader and renderers as... (!255246) • Asherah Connor • 19.6
• Do a final documentation once-over (Document <iframe> embeds (#597027))

Related issues

• The original customer request for embedding GitLab pipeline artifacts in an iframe (via @jcarrano) is tracked separately in Support iframe embedding of GitLab pipeline art... (#590071).