lib/onebox/engine/sketchfab_onebox.rb in onebox-2.0.2 vs lib/onebox/engine/sketchfab_onebox.rb in onebox-2.1.0

@@ -6,9 +6,10 @@
       include Engine
       include StandardEmbed
 
       matches_regexp(/^https?:\/\/sketchfab\.com\/(?:models\/|3d-models\/(?:[^\/\s]+-)?)([a-z0-9]{32})/)
       always_https
+      requires_iframe_origins("https://sketchfab.com")
 
       def to_html
         og = get_opengraph
         src = og.video_url.gsub("autostart=1", "")