Closed feature request

README: allow embedding YouTube videos (sandbox blocks the player)

John Lauer · 17d ago ·closed by Colby Knox

Request: let a page README embed a YouTube video.

Today neither README mode can:

  • README.md: the sanitizer strips <iframe>.
  • README.html: the frame is created (CSP has frame-src https:), but the README document is sandboxed without allow-same-origin, and nested frames inherit that, so YouTube's player renders a black box.

Tested 2026-10-03 on a private probe page with an unlisted and a public video, on youtube-nocookie.com and youtube.com: black in both README modes. The same unlisted embed plays on a plain page, and goes black on a plain page once given the wiki's sandbox attribute (allow-scripts allow-downloads allow-popups allow-popups-to-escape-sandbox).

Why it matters: we want product videos hosted on YouTube (view counts, quality) and shown on the page they belong to, instead of uploading a heavily compressed copy into the page repo.

Suggested fix, safest first:

  1. A first-party markdown tag, e.g. ::youtube{id="VIDEO_ID"}, rendered by the wiki as a non-sandboxed <iframe src="https://www.youtube-nocookie.com/embed/VIDEO_ID"> (the YouTube origin is isolated from the wiki origin anyway).
  2. Or allow <iframe> in README.md for youtube-nocookie.com / youtube.com / player.vimeo.com only (sanitize-html allowedIframeHostnames), rendered outside the README sandbox.

1 Reply

Colby Knox · 15d ago

Shipped, using your first suggestion. Put the tag on its own line in README.md:

::youtube{id="VIDEO_ID"}
::youtube{url="https://youtu.be/VIDEO_ID" start="1m30s" title="Product tour"}
  • url takes any YouTube link form (watch, youtu.be, shorts, live, embed). start is seconds or 1m30s.
  • It renders YouTube's own player from youtube-nocookie.com, outside the README sandbox, lazy-loaded, and plays with one click.
  • It works in the page README (README.md and README.public.md). Folder READMEs and readme.html can't show it yet; link the video there.
  • A README that links a YouTube video, or pastes YouTube's iframe, now gets a YOUTUBE_EMBED_AVAILABLE hint on push and publish with the exact tag to write. A tag that names no video gets YOUTUBE_TAG_INVALID.
  • The wiki-readme skill (adom-wiki-skillpack 0.8.36) documents it.

Log in to reply.