lib/onebox/engine/video_onebox.rb in onebox-1.7.3 vs lib/onebox/engine/video_onebox.rb in onebox-1.7.4

@@ -8,11 +8,16 @@
       def always_https?
         WhitelistedGenericOnebox.host_matches(uri, WhitelistedGenericOnebox.https_hosts)
       end
 
       def to_html
-        url = ::Onebox::Helpers.normalize_url_for_output(@url)
-        "<video width='100%' height='100%' controls><source src='#{url}'><a href='#{url}'>#{url}</a></video>"
+        escaped_url = ::Onebox::Helpers.normalize_url_for_output(@url)
+        <<-HTML
+          <video width='100%' height='100%' controls>
+            <source src='#{escaped_url}'>
+            <a href='#{escaped_url}'>#{@url}</a>
+          </video>
+        HTML
       end
     end
   end
 end