lightbox: Confine embedded video players to a unique origin.
lightbox: Confine embedded video players to a unique origin.

This fixes a cross-site scripting vulnerability in the upcoming Inline
URL Previews feature found by Graham Bleaney and Ibrahim Mohamed using
Pysa.

This commit doesn't get a CVE because the bug was present in a code
path introduced in the 2.1.x development branch, so it doesn't impact
any Zulip release.

Signed-off-by: Anders Kaseorg <dfdb7392591db597bc41cf266a9c3bc12a2706e5@zulipchat.com>

hackerkid/zulip,timabbott/zulip,andersk/zulip,punchagan/zulip,timabbott/zulip,shubhamdhama/zulip,shubhamdhama/zulip,shubhamdhama/zulip,brainwane/zulip,synicalsyntax/zulip,showell/zulip,andersk/zulip,rht/zulip,zulip/zulip,zulip/zulip,shubhamdhama/zulip,synicalsyntax/zulip,hackerkid/zulip,andersk/zulip,showell/zulip,timabbott/zulip,rht/zulip,punchagan/zulip,brainwane/zulip,shubhamdhama/zulip,kou/zulip,zulip/zulip,timabbott/zulip,showell/zulip,hackerkid/zulip,hackerkid/zulip,brainwane/zulip,zulip/zulip,showell/zulip,shubhamdhama/zulip,kou/zulip,rht/zulip,showell/zulip,punchagan/zulip,eeshangarg/zulip,rht/zulip,punchagan/zulip,punchagan/zulip,showell/zulip,hackerkid/zulip,eeshangarg/zulip,synicalsyntax/zulip,eeshangarg/zulip,rht/zulip,eeshangarg/zulip,rht/zulip,brainwane/zulip,timabbott/zulip,brainwane/zulip,synicalsyntax/zulip,zulip/zulip,timabbott/zulip,punchagan/zulip,hackerkid/zulip,zulip/zulip,brainwane/zulip,hackerkid/zulip,synicalsyntax/zulip,kou/zulip,kou/zulip,kou/zulip,punchagan/zulip,timabbott/zulip,brainwane/zulip,eeshangarg/zulip,synicalsyntax/zulip,zulip/zulip,kou/zulip,kou/zulip,andersk/zulip,andersk/zulip,synicalsyntax/zulip,shubhamdhama/zulip,showell/zulip,andersk/zulip,eeshangarg/zulip,andersk/zulip,rht/zulip,eeshangarg/zulip