Youtube embed causes file to download

Originator:seddon.ryan
Number:rdar://12497334 Date Originated:15-Oct-2012 05:00 PM
Status:Open Resolved:
Product:Safari Product Version:6
Classification:Security Reproducible:Always
 
Summary: Embedding a youtube video with /v/videoID URL causes file to download with the same name as the youtube video ID.

Steps to Reproduce:

Open any page with a youtube iframe embed with a /v/* url, see test case[1].

* Youtube has http://youtube.com/embed/videoID urls for embeds but older URLs had /v/
[1] http://codepen.io/ryanseddon/pen/Fdtpm

Expected Results:

Video embed to load video.

Actual Results:

Downloads a small binary file named the the same as the video ID e.g. NwaY0QJQ_WI will download in the above test case.

Regression:

Notes:

Not really sure if this should live under security but it'll definitely raise red flags if random files are downloaded.

Comments


Please note: Reports posted here will not necessarily be seen by Apple. All problems should be submitted at bugreport.apple.com before they are posted here. Please only post information for Radars that you have filed yourself, and please do not include Apple confidential information in your posts. Thank you!