From 565ca8d8bcc867bdc54383a7ea44019c2d0c0929 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 1 Sep 2026 00:27:14 +0000
Subject: [PATCH] fix: sanitize video block URL fields and scrub iframe sources
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The video block's `video_url`, `title_url`, `thumbnail_url`, and
`provider_icon_url` passed through every sanitization layer untouched,
and `slack-blocks-to-jsx` renders `video_url` straight into an
`<iframe src>`. A crafted payload — via the JSON drawer, the `?blocks=`
URL state, `initialBlocks`, or a consumer backend — reached the DOM as
`<iframe src="javascript:...">` (same-origin script execution on React
18) or `<iframe src="data:text/html,...">`, which renders and executes
in an opaque origin on every React version.

All three layers were scoped to the URL fields that existed when they
were written:

- the payload sanitizer keyed on exact-match sets `{'url'}` /
  `{'image_url'}`, so all four video fields were returned verbatim by
  both `sanitizeBlock` and `toSlackBlocks`;
- the renderer applies no scheme filter of its own;
- the post-render DOM scrub walked `a[href]` and `img[src]` only.

Rather than add four more keys to a list that has now missed a field
twice, classify keys by name shape: anything whose last `_`-delimited
segment reads as a URL is sanitized, with image-ish names getting the
image allowlist and `video_url` the new embed allowlist. Over-matching
is free — a URL-shaped key holding a non-URL string has no recognized
scheme, so it is treated as relative and passed through.

`isSafeEmbedSrc` is the narrowest of the three predicates: http(s)
only. A frame loads without a click, so it admits neither `data:` of
any media type nor relative URLs (which would frame the embedding app
itself), and none of the link-only schemes.

The DOM scrub gains a third arm over `iframe`/`embed`/`object`/
`source`/`video`/`audio`/`track` sources, and the video editor now
flags an unsafe URL inline like the structured rich-text editor does.

`test/preview-url-scrub.test.tsx` is the layer that was missing: it
renders hostile payloads and walks every element of the result,
asserting no URL-bearing attribute on any tag that navigates or
auto-loads carries anything but an http(s) URL — so a renderer upgrade
that emits a new URL-bearing tag, or a Slack block that adds a new URL
field, fails there rather than in the next report. All 14 new
assertions fail against the pre-fix tree.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JDfR9ZDU5CvVAf4gpFh9Wc
---
 SECURITY-REVIEW.md                            |  54 ++++++-
 src/components/editors/video-editor.tsx       |  48 ++++++
 .../preview/slack-block-preview.tsx           |  41 +++--
 src/lib/sanitize-blocks.ts                    | 100 ++++++++++---
 src/lib/url-safety.ts                         |  60 ++++++++
 test/preview-url-scrub.test.tsx               | 141 ++++++++++++++++++
 test/public-api.test.ts                       |  40 +++++
 test/sanitize-blocks.test.ts                  | 106 +++++++++++++
 test/url-safety.test.ts                       |  52 +++++++
 test/video-editor.test.tsx                    |  72 +++++++++
 10 files changed, 684 insertions(+), 30 deletions(-)
 create mode 100644 test/preview-url-scrub.test.tsx
 create mode 100644 test/video-editor.test.tsx

diff --git a/SECURITY-REVIEW.md b/SECURITY-REVIEW.md
index 948cc3c..0abb94e 100644
--- a/SECURITY-REVIEW.md
+++ b/SECURITY-REVIEW.md
@@ -143,6 +143,44 @@ Chromium.
 
 ---
 
+## Follow-up findings
+
+Reported after the review above, against the same code. Kept here so the
+URL-sanitization story reads in one place.
+
+### F-009 (High) — Video-block URL fields bypassed the F-001 sanitizer and reached an unsanitized `<iframe src>`
+
+- **Reported**: 2026-08-27, external report. **Fixed**: 2026-09-01.
+- **OWASP**: A03 Injection (DOM-XSS).
+- **Surfaces**: the same entry points as F-001 — JSON drawer, `decodeBlocksFromString` / the `?blocks=` URL state, `initialBlocks`, `onLoadMessage`, any consumer backend.
+- **Root cause**: all three F-001 layers were scoped to the URL fields that existed when they were written, and the video block's four are not among them.
+  1. The payload sanitizer keyed on exact-match sets `HREF_KEYS = {'url'}` / `IMAGE_KEYS = {'image_url'}`, so `video_url`, `title_url`, `thumbnail_url`, and `provider_icon_url` were returned verbatim — by `sanitizeBlock` at the preview boundary **and** by `toSlackBlocks`, the documented consumer hardening boundary.
+  2. `slack-blocks-to-jsx@1.1.2` renders `<iframe title={alt_text} src={video_url}>` with no scheme filter, the same gap F-001 documented for its anchors and images.
+  3. The post-render DOM scrub walked `a[href]` and `img[src]` only. `iframe[src]` was never inspected.
+- **Repro**: paste into the JSON drawer — the preview rendered `<iframe src="data:text/html,…">` with no `data-bk-blocked-*` marker, while the same block's `title_url` anchor *was* scrubbed to `href="#"` (the control proving layer 3 worked for anchors and not for frames).
+  ```jsonc
+  [
+    {
+      "type": "video",
+      "alt_text": "poc",
+      "title": { "type": "plain_text", "text": "PoC" },
+      "thumbnail_url": "https://example.com/t.png",
+      "video_url": "data:text/html,<script>top.__pwned=1</script>",
+      "block_id": "poc"
+    }
+  ]
+  ```
+- **Impact**: a `javascript:` `video_url` executes in the embedding app's origin on React 18 (an explicitly supported peer). React 19 blocks that one at `setAttribute` time, but `data:text/html` renders and executes on **every** React version — in an opaque origin, so phishing and UI-redress inside trusted chrome rather than token theft. Reproduced in jsdom: the frame navigation fires before any of our code runs.
+- **Fix**:
+  - `src/lib/url-safety.ts`: new `isSafeEmbedSrc` / `sanitizeEmbedSrc`. Tighter than both existing predicates — http(s) only. `data:` of any media type is rejected (a frame loads with no click, so `data:text/html` executes), as are scheme-less relative URLs (a relative frame source frames the embedding app itself) and the link-only schemes `mailto`/`tel`/`sms`/`xmpp`/`irc`.
+  - `src/lib/sanitize-blocks.ts`: the exact-match key sets are gone. Keys are classified by **name shape** — anything whose last `_`-delimited segment is `url`/`uri`/`link`/`href`/`src` is sanitized, image-ish names (`image`, `thumb`, `icon`, `avatar`, `logo`, `photo`, `picture`) get the image allowlist, `video_url` gets the embed allowlist, everything else gets the link allowlist. Over-matching is free: a URL-shaped key holding a non-URL string has no recognized scheme, so it is treated as relative and passed through. This is the structural half of the fix — a hand-maintained key set had by then missed a field twice.
+  - `src/components/preview/slack-block-preview.tsx`: a third scrub arm over `iframe[src], embed[src], object[data], source[src], video[src], audio[src], track[src]`, applying the embed allowlist and marking blocked elements `data-bk-blocked-src`.
+  - `src/components/editors/video-editor.tsx`: all four URL fields flag an unsafe value with `aria-invalid` and an inline note, matching the structured rich-text editor.
+- **Tests**: [test/preview-url-scrub.test.tsx](test/preview-url-scrub.test.tsx) is the one that would have caught this. It renders hostile payloads and then walks **every** element of the result, asserting that no URL-bearing attribute on any tag that navigates or auto-loads carries anything but an http(s) URL — rather than asserting on the fields we happen to know about today. A renderer upgrade that emits a new URL-bearing tag, or a Slack block that adds a new URL field, fails there. Field-level coverage in [test/sanitize-blocks.test.ts](test/sanitize-blocks.test.ts), [test/url-safety.test.ts](test/url-safety.test.ts), [test/public-api.test.ts](test/public-api.test.ts), and [test/video-editor.test.tsx](test/video-editor.test.tsx). All 14 new assertions fail against the pre-fix tree.
+- **Residual risk**: `slack-blocks-to-jsx` still has no scheme allowlist of its own; ours is applied on both sides of it. Pushing one upstream would close this class at the source for every consumer of that package.
+
+---
+
 ## Items checked and clean
 
 These were inspected, deemed safe as-shipped, and noted here so future reviewers can see what was covered:
@@ -155,7 +193,7 @@ These were inspected, deemed safe as-shipped, and noted here so future reviewers
 - **Clipboard reads**: none.
 - **Raw `fetch` / XHR**: not performed by the library; all I/O is brokered by consumer callbacks (`loadChannels`, `loadSendAsUserStatus`, `onSend`).
 - **File uploads / `FileReader` / `URL.createObjectURL`**: none.
-- **`<iframe>` elements**: none.
+- **`<iframe>` elements**: none constructed by `src/` itself — but `slack-blocks-to-jsx` renders one for the video block's `video_url`, which is what F-009 missed. The preview's DOM scrub now covers `iframe`/`embed`/`object`/`source`/`video`/`audio`/`track` sources, so "we don't write `<iframe>`" is not the same as "no `<iframe>` renders".
 - **`JSON.parse` of untrusted input**: two sites ([url-state.ts:42](src/lib/url-state.ts:42), [json-drawer.tsx:64](src/components/json-drawer.tsx:64)) — both wrapped in try/catch, top-level array check, and now size-capped. `__proto__` keys in JSON do not pollute `Object.prototype` in modern engines and the sanitizer was verified to be free of `Object.assign`-flavored merges that walk the prototype chain ([test/sanitize-blocks.test.ts](test/sanitize-blocks.test.ts) `prototype pollution shape`).
 - **Random IDs**: `nanoid@5.x` (CSPRNG-backed). Not used for security tokens; appropriate.
 - **Toolbar docs link**: [toolbar.tsx:158-166](src/components/toolbar.tsx:158) is a hardcoded `docs.slack.dev` URL with `rel="noreferrer noopener"`. Safe.
@@ -197,3 +235,17 @@ test/url-safety.test.ts                               (new)   F-001
 test/sanitize-blocks.test.ts                          (new)   F-001
 test/public-api.test.ts                               (edit)  F-001, F-004
 ```
+
+Follow-up:
+
+```
+src/lib/url-safety.ts                                 (edit)  F-009
+src/lib/sanitize-blocks.ts                            (edit)  F-009
+src/components/preview/slack-block-preview.tsx        (edit)  F-009
+src/components/editors/video-editor.tsx               (edit)  F-009
+test/preview-url-scrub.test.tsx                       (new)   F-009
+test/video-editor.test.tsx                            (new)   F-009
+test/url-safety.test.ts                               (edit)  F-009
+test/sanitize-blocks.test.ts                          (edit)  F-009
+test/public-api.test.ts                               (edit)  F-009
+```
diff --git a/src/components/editors/video-editor.tsx b/src/components/editors/video-editor.tsx
index eefa0bd..35a7c92 100644
--- a/src/components/editors/video-editor.tsx
+++ b/src/components/editors/video-editor.tsx
@@ -1,9 +1,24 @@
+import type { ReactNode } from 'react';
 import { Input } from '../../lib/ui/input';
 import { Textarea } from '../../lib/ui/textarea';
+import { isSafeEmbedSrc, isSafeHref, isSafeImageSrc } from '../../lib/url-safety';
 import type { VideoBlock } from '../../types';
 import { EditorField } from './field';
 import type { BlockEditorProps } from './types';
 
+/**
+ * Inline warning shown under a URL field whose value will be stripped by
+ * the sanitizer before it reaches the preview or Slack. Mirrors the
+ * structured rich-text editor's URL field so an unsafe paste explains
+ * itself instead of silently disappearing from the preview.
+ * @param props - warning props
+ * @param props.children - the rule that was broken, in plain language
+ * @returns the rendered warning
+ */
+function UnsafeUrlNote({ children }: { children: ReactNode }) {
+  return <p className="mt-1 text-[11px] text-destructive">{children}</p>;
+}
+
 /**
  * Editor form for video blocks. Edits the title, alt text, thumbnail/video
  * URLs, and optional provider/author/description metadata. Sending a video
@@ -16,6 +31,14 @@ import type { BlockEditorProps } from './types';
  * @returns the rendered video editor form
  */
 export function VideoEditor({ block, onChange }: BlockEditorProps<VideoBlock>) {
+  // The preview renders `video_url` into an `<iframe src>`, so it is held
+  // to http(s) only; the two image fields and the title link get the
+  // image / link allowlists that apply where they land in the DOM.
+  const videoUrlIsUnsafe = (block.video_url ?? '').length > 0 && !isSafeEmbedSrc(block.video_url);
+  const thumbnailIsUnsafe = (block.thumbnail_url ?? '').length > 0 && !isSafeImageSrc(block.thumbnail_url);
+  const titleUrlIsUnsafe = (block.title_url ?? '').length > 0 && !isSafeHref(block.title_url);
+  const providerIconIsUnsafe = (block.provider_icon_url ?? '').length > 0 && !isSafeImageSrc(block.provider_icon_url);
+
   return (
     <div className="flex flex-col gap-4">
       <EditorField label="Title" help="Up to 199 characters. Shown above the embedded player." htmlFor="video-title">
@@ -53,7 +76,13 @@ export function VideoEditor({ block, onChange }: BlockEditorProps<VideoBlock>) {
           value={block.video_url ?? ''}
           placeholder="e.g. https://www.youtube.com/embed/dQw4w9WgXcQ"
           onChange={(e) => onChange({ ...block, video_url: e.target.value })}
+          aria-invalid={videoUrlIsUnsafe || undefined}
         />
+        {videoUrlIsUnsafe && (
+          <UnsafeUrlNote>
+            The embedded player only accepts a full http(s) URL. This URL will be stripped before send and preview.
+          </UnsafeUrlNote>
+        )}
       </EditorField>
 
       <EditorField label="Thumbnail URL" help="Preview image shown before the video loads." htmlFor="video-thumbnail">
@@ -63,7 +92,13 @@ export function VideoEditor({ block, onChange }: BlockEditorProps<VideoBlock>) {
           value={block.thumbnail_url ?? ''}
           placeholder="e.g. https://example.com/thumb.png"
           onChange={(e) => onChange({ ...block, thumbnail_url: e.target.value })}
+          aria-invalid={thumbnailIsUnsafe || undefined}
         />
+        {thumbnailIsUnsafe && (
+          <UnsafeUrlNote>
+            Only http(s) image URLs are allowed. This URL will be stripped before send and preview.
+          </UnsafeUrlNote>
+        )}
       </EditorField>
 
       <EditorField
@@ -77,7 +112,14 @@ export function VideoEditor({ block, onChange }: BlockEditorProps<VideoBlock>) {
           value={block.title_url ?? ''}
           placeholder="e.g. https://www.youtube.com/watch?v=dQw4w9WgXcQ"
           onChange={(e) => onChange({ ...block, title_url: e.target.value || undefined })}
+          aria-invalid={titleUrlIsUnsafe || undefined}
         />
+        {titleUrlIsUnsafe && (
+          <UnsafeUrlNote>
+            Only http(s), mailto, tel, sms, and xmpp links are allowed. This URL will be stripped before send and
+            preview.
+          </UnsafeUrlNote>
+        )}
       </EditorField>
 
       <EditorField label="Description" help="Optional. Up to 199 characters." htmlFor="video-description">
@@ -130,7 +172,13 @@ export function VideoEditor({ block, onChange }: BlockEditorProps<VideoBlock>) {
           value={block.provider_icon_url ?? ''}
           placeholder="e.g. https://example.com/youtube-favicon.png"
           onChange={(e) => onChange({ ...block, provider_icon_url: e.target.value || undefined })}
+          aria-invalid={providerIconIsUnsafe || undefined}
         />
+        {providerIconIsUnsafe && (
+          <UnsafeUrlNote>
+            Only http(s) image URLs are allowed. This URL will be stripped before send and preview.
+          </UnsafeUrlNote>
+        )}
       </EditorField>
     </div>
   );
diff --git a/src/components/preview/slack-block-preview.tsx b/src/components/preview/slack-block-preview.tsx
index f821d32..f72ae16 100644
--- a/src/components/preview/slack-block-preview.tsx
+++ b/src/components/preview/slack-block-preview.tsx
@@ -4,9 +4,18 @@ import { useEffect, useMemo, useRef } from 'react';
 import type { Block } from 'slack-blocks-to-jsx';
 import { Message } from 'slack-blocks-to-jsx';
 import { sanitizeBlock } from '../../lib/sanitize-blocks';
-import { isSafeHref, isSafeImageSrc } from '../../lib/url-safety';
+import { isSafeEmbedSrc, isSafeHref, isSafeImageSrc } from '../../lib/url-safety';
 import type { PreviewHooks, PreviewTheme, SupportedBlock } from '../../types';
 
+/**
+ * Elements whose source attribute makes the browser load a document or
+ * subresource on its own, with no click. `slack-blocks-to-jsx` renders a
+ * video block's `video_url` into `<iframe src>`; the rest are covered so
+ * a renderer upgrade that starts emitting one of them is scrubbed from
+ * day one rather than after the next report.
+ */
+const EMBED_SELECTOR = 'iframe[src], embed[src], object[data], source[src], video[src], audio[src], track[src]';
+
 /**
  * Renders a Slack block via the `slack-blocks-to-jsx` library's `<Message>`
  * component. We render exactly one block at a time so each row in the
@@ -47,16 +56,19 @@ export function SlackBlockPreview({
   // video blocks without an aria-label, which violates axe's `button-name`
   // rule and is unreachable to screen readers. Post-mount we add a label
   // to any such buttons we find under our wrapper. We also do a final
-  // pass to neutralize any `<a href>` or `<img src>` that carries a
-  // disallowed URI scheme — the block-payload sanitizer catches URLs
-  // that live in structured fields (`url`, `image_url`), but mrkdwn /
-  // rich-text content can encode link URLs inside text strings
-  // (`[label](javascript:...)` or `<javascript:...|label>`) that
-  // `slack-blocks-to-jsx`'s own parser hands straight to `<a href>`
-  // without filtering. React 19 also blocks `javascript:` URLs at
-  // setAttribute time, but we don't rely on that — this loop applies
-  // our allowlist (which is tighter and covers `data:`/`vbscript:`/`file:`
-  // as well) and replaces unsafe values with `#`.
+  // pass to neutralize any `<a href>`, `<img src>`, or frame/subresource
+  // source that carries a disallowed URI scheme — the block-payload
+  // sanitizer catches URLs that live in structured fields (`url`,
+  // `image_url`, `video_url`), but mrkdwn / rich-text content can encode
+  // link URLs inside text strings (`[label](javascript:...)` or
+  // `<javascript:...|label>`) that `slack-blocks-to-jsx`'s own parser
+  // hands straight to `<a href>` without filtering. React 19 also blocks
+  // `javascript:` URLs at setAttribute time, but we don't rely on that —
+  // this loop applies our allowlist (which is tighter and covers
+  // `data:`/`vbscript:`/`file:` as well) and replaces unsafe values with
+  // `#`. Frames get the strictest arm: an `<iframe src>` loads on render
+  // rather than on click, so `data:text/html` there executes script in an
+  // opaque origin on every React version and only http(s) is allowed.
   useEffect(() => {
     const root = rootRef.current;
     if (!root) return;
@@ -82,6 +94,13 @@ export function SlackBlockPreview({
         img.setAttribute('data-bk-blocked-src', '1');
       }
     }
+    for (const el of root.querySelectorAll<HTMLElement>(EMBED_SELECTOR)) {
+      const attr = el.tagName === 'OBJECT' ? 'data' : 'src';
+      if (!isSafeEmbedSrc(el.getAttribute(attr))) {
+        el.removeAttribute(attr);
+        el.setAttribute('data-bk-blocked-src', '1');
+      }
+    }
   });
 
   return (
diff --git a/src/lib/sanitize-blocks.ts b/src/lib/sanitize-blocks.ts
index 6a37a2f..5cbf8a5 100644
--- a/src/lib/sanitize-blocks.ts
+++ b/src/lib/sanitize-blocks.ts
@@ -1,12 +1,9 @@
-import type { SupportedBlock } from '../types';
-import { sanitizeHref, sanitizeImageSrc } from './url-safety';
-
 /**
- * Recursively walks an unknown value and rewrites string values at the
- * specified keys via the matching sanitizer. Used to strip dangerous
- * URI schemes (e.g. `javascript:`) from `url`, `image_url`, and
- * rich-text link `url` fields before a Block Kit payload reaches a
- * renderer or is handed back to the consumer.
+ * Recursively walks an unknown value and rewrites every URL-bearing
+ * string field via the matching sanitizer. Used to strip dangerous URI
+ * schemes (e.g. `javascript:`, `data:text/html`) from `url`,
+ * `image_url`, `video_url`, rich-text link `url` and friends before a
+ * Block Kit payload reaches a renderer or is handed back to the consumer.
  *
  * Allocates a new object whenever a child is rewritten; otherwise
  * returns the input unchanged so unaffected payloads are reference-stable.
@@ -15,8 +12,71 @@ import { sanitizeHref, sanitizeImageSrc } from './url-safety';
  * `Object.assign({}, ...)` over own enumerable keys returned by
  * `Object.keys`, which skips inherited properties.
  */
-const HREF_KEYS = new Set(['url']);
-const IMAGE_KEYS = new Set(['image_url']);
+
+import type { SupportedBlock } from '../types';
+import { sanitizeEmbedSrc, sanitizeHref, sanitizeImageSrc } from './url-safety';
+
+/**
+ * Which allowlist applies to a URL-bearing field, by where its value
+ * ends up in the DOM: an `<a href>`, an `<img src>`, or a frame /
+ * subresource source such as `<iframe src>`.
+ */
+type UrlKind = 'href' | 'image' | 'embed';
+
+/**
+ * Fields whose value the renderer puts in a nested browsing context.
+ * `slack-blocks-to-jsx` renders the video block's `video_url` into
+ * `<iframe src>`, which loads without a click — so these get the
+ * http(s)-only allowlist rather than the link one.
+ */
+const EMBED_KEYS = new Set(['video_url']);
+
+/**
+ * Key names whose value is a URL. Matched on the last `_`-delimited
+ * segment so a field added by Slack later (`title_url`,
+ * `provider_icon_url`, `author_link`, …) is covered on arrival.
+ *
+ * This is deliberately a name *shape* rather than an exact-match list:
+ * two rounds of URL-sanitizer hardening each shipped with a
+ * hand-maintained key set, and each silently missed a field Slack had
+ * added. Over-matching is cheap — a key that looks like a URL but holds
+ * something else keeps its value, because a string with no recognized
+ * scheme is treated as a relative URL and passed through untouched.
+ */
+const URL_KEY = /(^|_)(url|uri|link|href|src)$/;
+
+/** Cheap pre-filter so the classifier's regexes skip ordinary keys. */
+const MAYBE_URL_KEY = /url|uri|link|href|src/i;
+
+/**
+ * Name fragments that mark a URL field as an image source. Image
+ * sources are allowed to carry a `data:image/<safe-mime>` payload —
+ * Slack emits those for some emoji and file thumbnails — which the
+ * link allowlist rejects.
+ */
+const IMAGE_KEY_HINT = /image|thumb|icon|avatar|logo|photo|picture/;
+
+/**
+ * Classifies a payload key by the kind of URL it carries, or `null`
+ * when the key holds no URL at all.
+ * @param key - the payload object's key
+ * @returns which allowlist applies, or `null` to leave the value alone
+ */
+function classifyUrlKey(key: string): UrlKind | null {
+  if (!MAYBE_URL_KEY.test(key)) {
+    return null;
+  }
+  // Fold camelCase to snake_case first so a consumer payload that isn't
+  // strict Slack JSON (`videoUrl`, `iconUrl`) classifies the same way.
+  const normalized = key.replace(/([a-z0-9])([A-Z])/g, '$1_$2').toLowerCase();
+  if (EMBED_KEYS.has(normalized)) {
+    return 'embed';
+  }
+  if (!URL_KEY.test(normalized)) {
+    return null;
+  }
+  return IMAGE_KEY_HINT.test(normalized) ? 'image' : 'href';
+}
 
 /**
  * Read-only metadata Slack attaches when a message is *retrieved* via the
@@ -35,11 +95,11 @@ const RETRIEVAL_ONLY_KEYS = new Map<string, Set<string>>([
 ]);
 
 /**
- * Recursively sanitize all known URL-bearing string fields inside a
- * Slack Block Kit payload fragment. Returns a value with the same
- * structural shape, where any field whose name matches an href or
- * image-src key has been replaced by the safe variant (`''` if the
- * original scheme was unsafe).
+ * Recursively sanitize every URL-bearing string field inside a Slack
+ * Block Kit payload fragment. Returns a value with the same structural
+ * shape, where any field whose name reads as a URL has been replaced by
+ * the safe variant (`''` if the original scheme was unsafe for the kind
+ * of URL that field carries — see {@link classifyUrlKey}).
  * @param value - any payload fragment (object, array, primitive)
  * @returns the sanitized payload fragment
  */
@@ -71,10 +131,13 @@ function sanitizeValue(value: unknown): unknown {
     const original = src[key];
     let next: unknown = original;
     if (typeof original === 'string') {
-      if (HREF_KEYS.has(key)) {
+      const kind = classifyUrlKey(key);
+      if (kind === 'href') {
         next = sanitizeHref(original);
-      } else if (IMAGE_KEYS.has(key)) {
+      } else if (kind === 'image') {
         next = sanitizeImageSrc(original);
+      } else if (kind === 'embed') {
+        next = sanitizeEmbedSrc(original);
       }
     } else if (typeof original === 'object' && original !== null) {
       next = sanitizeValue(original);
@@ -91,7 +154,8 @@ function sanitizeValue(value: unknown): unknown {
 
 /**
  * Sanitize a single Block Kit block, scrubbing dangerous URI schemes
- * from `url` and `image_url` fields anywhere in the payload tree.
+ * from every URL-bearing field anywhere in the payload tree (`url`,
+ * `image_url`, `video_url`, `thumbnail_url`, `title_url`, …).
  * @param block - the block payload to sanitize
  * @returns the sanitized block (same reference if nothing changed)
  */
diff --git a/src/lib/url-safety.ts b/src/lib/url-safety.ts
index 239a2dc..f0d3409 100644
--- a/src/lib/url-safety.ts
+++ b/src/lib/url-safety.ts
@@ -35,6 +35,22 @@ const SAFE_IMAGE_PROTOCOLS = /^(https?)$/i;
 const SAFE_IMAGE_DATA_PREFIX =
   /^data:image\/(?:png|jpeg|jpg|gif|webp|avif|x-icon|vnd\.microsoft\.icon)(?:;[a-z0-9-]+(?:=[^,;]*)?)*,/i;
 
+/**
+ * Schemes safe to use as the source of a nested browsing context or an
+ * auto-loaded subresource — `<iframe src>` (the video block's
+ * `video_url`), `<embed src>`, `<object data>`, `<source src>`.
+ *
+ * Same schemes as {@link SAFE_IMAGE_PROTOCOLS}, but kept separate
+ * because the surrounding predicate is the narrowest of the three in
+ * this file and the two policies must be free to diverge: a frame
+ * source is fetched and rendered with no click, so it admits neither
+ * the `data:image/*` payloads an `<img>` may carry, the relative URLs
+ * both other predicates pass through, nor the `mailto`/`tel`/`sms`/
+ * `xmpp`/`irc` schemes that are harmless in a link the user chooses to
+ * follow.
+ */
+const SAFE_EMBED_PROTOCOLS = /^(https?)$/i;
+
 /**
  * Splits a URL into its scheme prefix and tail without invoking the
  * `URL` constructor (which throws on relative URLs and varies in how
@@ -146,6 +162,39 @@ export function isSafeImageSrc(value: string | null | undefined): boolean {
   return SAFE_IMAGE_PROTOCOLS.test(scheme);
 }
 
+/**
+ * Returns true when `value` is safe to use as an `<iframe src>` or any
+ * other attribute that makes the browser load a document/subresource on
+ * its own (`<embed src>`, `<object data>`, `<source src>`).
+ *
+ * Accepts http(s) and the empty string (an empty `src` loads
+ * `about:blank` per the HTML spec, so the caller may leave it in place).
+ * Everything else is rejected, including two cases the link and image
+ * predicates accept:
+ *  - `data:` of any media type. `data:text/html,<script>…</script>` in a
+ *    frame renders and executes in an opaque origin on every React
+ *    version — the variant of this bug that no React runtime guard stops.
+ *  - scheme-less (relative) URLs. A relative frame source points at a
+ *    page of the embedding app itself, which is a UI-redress vector
+ *    rather than a legitimate embed; Slack requires `video_url` to be an
+ *    https URL on one of the app's configured unfurl domains.
+ * @param value - the candidate URL
+ * @returns true when the URL is safe to load as a frame or subresource
+ */
+export function isSafeEmbedSrc(value: string | null | undefined): boolean {
+  if (typeof value !== 'string') {
+    return false;
+  }
+  if (value.length === 0) {
+    return true;
+  }
+  const scheme = getScheme(value);
+  if (scheme === null) {
+    return false;
+  }
+  return SAFE_EMBED_PROTOCOLS.test(scheme);
+}
+
 /**
  * Returns `value` if it passes {@link isSafeHref}, otherwise an empty
  * string. Use at render time / payload boundaries so an unsafe URL
@@ -166,3 +215,14 @@ export function sanitizeHref(value: string | null | undefined): string {
 export function sanitizeImageSrc(value: string | null | undefined): string {
   return isSafeImageSrc(value) ? (value ?? '') : '';
 }
+
+/**
+ * Returns `value` if it passes {@link isSafeEmbedSrc}, otherwise an
+ * empty string. Use at render time / payload boundaries so an unsafe URL
+ * never reaches the DOM as a frame or subresource source.
+ * @param value - the candidate URL
+ * @returns the URL if safe, or `''`
+ */
+export function sanitizeEmbedSrc(value: string | null | undefined): string {
+  return isSafeEmbedSrc(value) ? (value ?? '') : '';
+}
diff --git a/test/preview-url-scrub.test.tsx b/test/preview-url-scrub.test.tsx
new file mode 100644
index 0000000..768e28f
--- /dev/null
+++ b/test/preview-url-scrub.test.tsx
@@ -0,0 +1,141 @@
+import { render } from '@testing-library/react';
+import { SlackBlockPreview } from '../src/components/preview/slack-block-preview';
+import type { SupportedBlock } from '../src/types';
+
+/**
+ * Whole-DOM regression net for the preview boundary.
+ *
+ * Two rounds of URL-sanitizer hardening each covered the URL fields
+ * known at the time and each missed one Slack had added — anchors and
+ * images were scrubbed while the video block's `video_url` reached
+ * `<iframe src>` untouched. Rather than assert on the fields we happen
+ * to know about, these tests render hostile payloads and then walk
+ * everything the renderer produced, asserting that no element that
+ * navigates or auto-loads carries anything but an http(s) URL.
+ *
+ * A future renderer upgrade that starts emitting a new URL-bearing tag,
+ * or a Slack block that adds a new URL field, fails here.
+ */
+
+/** Every attribute the browser will resolve as a URL, by tag. */
+const URL_ATTRS: Record<string, string[]> = {
+  A: ['href'],
+  AREA: ['href'],
+  IMG: ['src', 'srcset'],
+  IFRAME: ['src', 'srcdoc'],
+  EMBED: ['src'],
+  OBJECT: ['data'],
+  SOURCE: ['src', 'srcset'],
+  VIDEO: ['src', 'poster'],
+  AUDIO: ['src'],
+  TRACK: ['src'],
+  SCRIPT: ['src'],
+  LINK: ['href'],
+  FORM: ['action'],
+  BUTTON: ['formaction'],
+  INPUT: ['formaction', 'src']
+};
+
+/** A URL that cannot execute script or frame the embedding app. */
+function isInert(value: string): boolean {
+  // Empty, `#`, and a removed attribute are all no-ops; anything else
+  // must be an explicit http(s) URL.
+  return value === '' || value === '#' || /^https?:\/\//i.test(value);
+}
+
+/**
+ * Collects every URL-bearing attribute the render produced that is not
+ * inert, as `tag[attr]="value"` strings for a readable failure message.
+ * @param root - the rendered container
+ * @returns the offending attributes, empty when the DOM is clean
+ */
+function unsafeUrlAttributes(root: HTMLElement): string[] {
+  const found: string[] = [];
+  for (const el of root.querySelectorAll<HTMLElement>('*')) {
+    for (const attr of URL_ATTRS[el.tagName] ?? []) {
+      const value = el.getAttribute(attr);
+      if (value !== null && !isInert(value)) {
+        found.push(`${el.tagName.toLowerCase()}[${attr}]=${JSON.stringify(value)}`);
+      }
+    }
+  }
+  return found;
+}
+
+const HOSTILE_URLS = [
+  "javascript:top.__pwned='R18-same-origin-XSS'",
+  'data:text/html,<script>top.__pwned_data=1</script>',
+  'vbscript:msgbox(1)',
+  'file:///etc/passwd'
+];
+
+const hostileVideo = (url: string): SupportedBlock =>
+  ({
+    type: 'video',
+    alt_text: 'poc',
+    title: { type: 'plain_text', text: 'PoC' },
+    thumbnail_url: url,
+    video_url: url,
+    title_url: url,
+    provider_icon_url: url,
+    provider_name: 'Evil',
+    author_name: 'Evil',
+    description: { type: 'plain_text', text: 'poc' },
+    block_id: 'poc'
+  }) as unknown as SupportedBlock;
+
+describe('SlackBlockPreview renders no executable URL', () => {
+  it.each(HOSTILE_URLS)('scrubs every URL field of a video block carrying %p', (url) => {
+    const { container } = render(<SlackBlockPreview block={hostileVideo(url)} />);
+    expect(unsafeUrlAttributes(container)).toEqual([]);
+  });
+
+  it('leaves the video iframe pointed at about:blank rather than a hostile URL', () => {
+    const { container } = render(<SlackBlockPreview block={hostileVideo('data:text/html,<script>1</script>')} />);
+    const iframe = container.querySelector('iframe');
+    expect(iframe).not.toBeNull();
+    // Absent or empty — the HTML spec loads about:blank for both, and
+    // which one React leaves behind for an empty `src` prop varies by
+    // major version.
+    expect(iframe?.getAttribute('src') ?? '').toBe('');
+  });
+
+  it('renders a legitimate https video block unchanged', () => {
+    const block = {
+      type: 'video',
+      alt_text: 'Product demo',
+      title: { type: 'plain_text', text: 'Demo' },
+      thumbnail_url: 'https://example.com/thumb.png',
+      video_url: 'https://www.youtube.com/embed/dQw4w9WgXcQ',
+      title_url: 'https://www.youtube.com/watch?v=dQw4w9WgXcQ',
+      provider_icon_url: 'https://example.com/favicon.png',
+      provider_name: 'YouTube'
+    } as unknown as SupportedBlock;
+
+    const { container } = render(<SlackBlockPreview block={block} />);
+
+    expect(container.querySelector('iframe')?.getAttribute('src')).toBe('https://www.youtube.com/embed/dQw4w9WgXcQ');
+    expect(unsafeUrlAttributes(container)).toEqual([]);
+  });
+
+  it.each(HOSTILE_URLS)('scrubs mrkdwn and rich-text links carrying %p', (url) => {
+    const blocks: SupportedBlock[] = [
+      { type: 'section', text: { type: 'mrkdwn', text: `[click](${url}) and <${url}|label>` } },
+      {
+        type: 'rich_text',
+        elements: [{ type: 'rich_text_section', elements: [{ type: 'link', url, text: 'click me' }] }]
+      } as unknown as SupportedBlock,
+      { type: 'image', image_url: url, alt_text: 'evil' } as unknown as SupportedBlock,
+      {
+        type: 'section',
+        text: { type: 'mrkdwn', text: 'hi' },
+        accessory: { type: 'button', text: { type: 'plain_text', text: 'Go' }, url, action_id: 'a' }
+      } as unknown as SupportedBlock
+    ];
+
+    for (const block of blocks) {
+      const { container } = render(<SlackBlockPreview block={block} />);
+      expect(unsafeUrlAttributes(container)).toEqual([]);
+    }
+  });
+});
diff --git a/test/public-api.test.ts b/test/public-api.test.ts
index dcbb0ea..7cfa2c4 100644
--- a/test/public-api.test.ts
+++ b/test/public-api.test.ts
@@ -147,6 +147,46 @@ describe('toSlackBlocks URL sanitization', () => {
     const [out] = toSlackBlocks(input);
     expect((out as { image_url: string }).image_url).toBe('');
   });
+
+  // `toSlackBlocks` is the documented hardening boundary for consumers
+  // that render a payload outside the builder's preview, so every URL
+  // field on the video block has to be scrubbed here too — not just the
+  // ones the payload sanitizer knew about when it was written.
+  it('scrubs every unsafe URL field on a video block', () => {
+    const input = [
+      {
+        type: 'video',
+        alt_text: 'poc',
+        title: { type: 'plain_text', text: 'PoC' },
+        thumbnail_url: 'javascript:alert(1)',
+        video_url: 'data:text/html,<script>top.__pwned=1</script>',
+        title_url: 'javascript:alert(2)',
+        provider_icon_url: 'data:image/svg+xml,<svg onload=alert(3)>'
+      }
+    ] as unknown as SupportedBlock[];
+
+    const [out] = toSlackBlocks(input) as unknown as Record<string, string>[];
+    expect(out.video_url).toBe('');
+    expect(out.thumbnail_url).toBe('');
+    expect(out.title_url).toBe('');
+    expect(out.provider_icon_url).toBe('');
+  });
+
+  it('passes a legitimate https video block through unchanged', () => {
+    const input = [
+      {
+        type: 'video',
+        alt_text: 'Product demo',
+        title: { type: 'plain_text', text: 'Demo', emoji: true },
+        thumbnail_url: 'https://example.com/thumb.png',
+        video_url: 'https://www.youtube.com/embed/dQw4w9WgXcQ',
+        title_url: 'https://www.youtube.com/watch?v=dQw4w9WgXcQ'
+      }
+    ] as unknown as SupportedBlock[];
+
+    expect(toSlackBlocks(input)).toEqual(input);
+    expect(validateBlockKit(toSlackBlocks(input), { target: 'blocks' }).valid).toBe(true);
+  });
 });
 
 describe('palette factories', () => {
diff --git a/test/sanitize-blocks.test.ts b/test/sanitize-blocks.test.ts
index 9bbe990..4f7812f 100644
--- a/test/sanitize-blocks.test.ts
+++ b/test/sanitize-blocks.test.ts
@@ -88,6 +88,112 @@ describe('sanitizeBlock', () => {
   });
 });
 
+describe('video block URL fields', () => {
+  // Regression: the sanitizer keyed on an exact-match set of `url` /
+  // `image_url`, so every URL field on the video block passed through
+  // verbatim and `video_url` reached `<iframe src>` unfiltered.
+  const evilVideo = (overrides: Record<string, unknown> = {}): SupportedBlock =>
+    ({
+      type: 'video',
+      alt_text: 'poc',
+      title: { type: 'plain_text', text: 'PoC' },
+      thumbnail_url: 'javascript:alert(1)',
+      video_url: "javascript:top.__pwned='R18-same-origin-XSS'",
+      title_url: 'javascript:alert(2)',
+      provider_icon_url: 'data:text/html,<script>alert(3)</script>',
+      block_id: 'poc',
+      ...overrides
+    }) as unknown as SupportedBlock;
+
+  it('scrubs javascript: from every URL field on a video block', () => {
+    const out = sanitizeBlock(evilVideo()) as unknown as Record<string, string>;
+    expect(out.video_url).toBe('');
+    expect(out.thumbnail_url).toBe('');
+    expect(out.title_url).toBe('');
+    expect(out.provider_icon_url).toBe('');
+    // Non-URL fields are untouched.
+    expect(out.alt_text).toBe('poc');
+    expect(out.block_id).toBe('poc');
+  });
+
+  it('scrubs data:text/html from video_url — the variant no React version blocks', () => {
+    const out = sanitizeBlock(evilVideo({ video_url: 'data:text/html,<script>top.__pwned=1</script>' }));
+    expect((out as unknown as { video_url: string }).video_url).toBe('');
+  });
+
+  it('holds video_url to http(s) only, where an <a href> would allow more', () => {
+    for (const unsafe of ['mailto:a@b.com', 'tel:+15551234', '/relative/page', '//evil.example.com/x']) {
+      const out = sanitizeBlock(evilVideo({ video_url: unsafe }));
+      expect((out as unknown as { video_url: string }).video_url).toBe('');
+    }
+  });
+
+  it('leaves a legitimate https video block untouched', () => {
+    const block = {
+      type: 'video',
+      alt_text: 'Product demo',
+      title: { type: 'plain_text', text: 'Demo' },
+      thumbnail_url: 'https://example.com/thumb.png',
+      video_url: 'https://www.youtube.com/embed/dQw4w9WgXcQ',
+      title_url: 'https://www.youtube.com/watch?v=dQw4w9WgXcQ',
+      provider_icon_url: 'https://example.com/favicon.png'
+    } as unknown as SupportedBlock;
+    expect(sanitizeBlock(block)).toBe(block);
+  });
+
+  it('still allows a data:image thumbnail, which the embed rule would reject', () => {
+    const png = 'data:image/png;base64,iVBORw0KGgo=';
+    const block = {
+      type: 'video',
+      alt_text: 'ok',
+      title: { type: 'plain_text', text: 'ok' },
+      thumbnail_url: png,
+      video_url: 'https://www.youtube.com/embed/abc'
+    } as unknown as SupportedBlock;
+    expect((sanitizeBlock(block) as unknown as { thumbnail_url: string }).thumbnail_url).toBe(png);
+  });
+});
+
+describe('URL keys are matched by name shape, not an exact list', () => {
+  // The key set was hand-maintained twice and silently missed a field
+  // both times. Any key whose last `_`-delimited segment reads as a URL
+  // is sanitized, so a field Slack adds later is covered on arrival.
+  it.each(['url', 'image_url', 'thumbnail_url', 'title_url', 'provider_icon_url', 'author_link', 'author_icon_url'])(
+    'scrubs an unsafe value at key %p',
+    (key) => {
+      const block = { type: 'section', [key]: 'javascript:alert(1)' } as unknown as SupportedBlock;
+      expect((sanitizeBlock(block) as unknown as Record<string, string>)[key]).toBe('');
+    }
+  );
+
+  it('classifies a camelCase key the same way as its snake_case form', () => {
+    const block = {
+      type: 'section',
+      videoUrl: 'javascript:alert(1)',
+      iconUrl: 'data:text/html,x'
+    } as unknown as SupportedBlock;
+    const out = sanitizeBlock(block) as unknown as Record<string, string>;
+    expect(out.videoUrl).toBe('');
+    expect(out.iconUrl).toBe('');
+  });
+
+  it('leaves keys that merely contain a URL-ish word alone', () => {
+    const block = {
+      type: 'section',
+      url_label: 'javascript:not-a-url-field',
+      source_of_truth: 'javascript:also-not-one'
+    } as unknown as SupportedBlock;
+    const out = sanitizeBlock(block) as unknown as Record<string, string>;
+    expect(out.url_label).toBe('javascript:not-a-url-field');
+    expect(out.source_of_truth).toBe('javascript:also-not-one');
+  });
+
+  it('passes a non-URL string at a URL-shaped key through untouched', () => {
+    const block = { type: 'section', tracking_url: 'not actually a url' } as unknown as SupportedBlock;
+    expect(sanitizeBlock(block)).toBe(block);
+  });
+});
+
 describe('sanitizeBlocks', () => {
   it('returns the same array reference when nothing needs rewriting', () => {
     const blocks: SupportedBlock[] = [{ type: 'divider' }];
diff --git a/test/url-safety.test.ts b/test/url-safety.test.ts
index 20531fb..4eeba27 100644
--- a/test/url-safety.test.ts
+++ b/test/url-safety.test.ts
@@ -1,7 +1,9 @@
 import {
   hasExplicitSafeScheme,
+  isSafeEmbedSrc,
   isSafeHref,
   isSafeImageSrc,
+  sanitizeEmbedSrc,
   sanitizeHref,
   sanitizeImageSrc
 } from '../src/lib/url-safety';
@@ -76,6 +78,47 @@ describe('isSafeImageSrc', () => {
   });
 });
 
+describe('isSafeEmbedSrc (iframe / subresource sources)', () => {
+  it.each(['https://www.youtube.com/embed/abc', 'http://example.com/player?v=1', ''])(
+    'accepts safe embed src %p',
+    (input) => {
+      expect(isSafeEmbedSrc(input)).toBe(true);
+    }
+  );
+
+  it.each([
+    'javascript:alert(1)',
+    ' javascript:top.__pwned=1',
+    'JaVaScRiPt:alert(1)',
+    // The variant no React version blocks: renders and executes in an
+    // opaque origin.
+    'data:text/html,<script>alert(1)</script>',
+    'data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==',
+    // A `data:image/*` payload is fine in an `<img>` but has no business
+    // being framed, so the embed allowlist is tighter than the image one.
+    'data:image/png;base64,iVBORw0KGgo=',
+    'vbscript:msgbox(1)',
+    'file:///etc/passwd',
+    'about:blank',
+    'ftp://example.com/clip.mp4',
+    // Unlike hrefs and image sources, a relative URL is NOT safe here: it
+    // frames a page of the embedding app itself.
+    '/relative/page',
+    './sibling',
+    '//protocol-relative.example.com/x',
+    'relative-no-scheme',
+    // Link schemes that are harmless to click but meaningless to frame.
+    'mailto:foo@example.com',
+    'tel:+1234567890'
+  ])('rejects unsafe embed src %p', (input) => {
+    expect(isSafeEmbedSrc(input)).toBe(false);
+  });
+
+  it.each([null, undefined, 0, false, {}, [], 42])('rejects non-string %p', (input) => {
+    expect(isSafeEmbedSrc(input as unknown as string)).toBe(false);
+  });
+});
+
 describe('hasExplicitSafeScheme (autolink gate)', () => {
   it.each([
     'https://example.com',
@@ -141,6 +184,15 @@ describe('sanitize*', () => {
     expect(sanitizeImageSrc('data:image/svg+xml,<svg onload=alert(1)>')).toBe('');
   });
 
+  it('sanitizeEmbedSrc returns the URL when safe', () => {
+    expect(sanitizeEmbedSrc('https://www.youtube.com/embed/abc')).toBe('https://www.youtube.com/embed/abc');
+  });
+
+  it('sanitizeEmbedSrc returns empty string when unsafe', () => {
+    expect(sanitizeEmbedSrc('data:text/html,<script>alert(1)</script>')).toBe('');
+    expect(sanitizeEmbedSrc('javascript:alert(1)')).toBe('');
+  });
+
   it('sanitizeHref preserves an empty string', () => {
     expect(sanitizeHref('')).toBe('');
   });
diff --git a/test/video-editor.test.tsx b/test/video-editor.test.tsx
new file mode 100644
index 0000000..b4eabaf
--- /dev/null
+++ b/test/video-editor.test.tsx
@@ -0,0 +1,72 @@
+import { fireEvent, render, screen } from '@testing-library/react';
+import { BlockEditor } from '../src/components/editors/block-editor';
+import type { VideoBlock } from '../src/types';
+
+const VIDEO_BLOCK: VideoBlock = {
+  type: 'video',
+  alt_text: 'Product demo',
+  title: { type: 'plain_text', text: 'Demo', emoji: true },
+  thumbnail_url: 'https://example.com/thumb.png',
+  video_url: 'https://www.youtube.com/embed/dQw4w9WgXcQ',
+  block_id: 'vid_1'
+};
+
+function input(label: string): HTMLInputElement {
+  return screen.getByLabelText(label) as HTMLInputElement;
+}
+
+describe('VideoEditor URL validation', () => {
+  it('flags nothing on a block whose URLs are all safe', () => {
+    render(<BlockEditor block={VIDEO_BLOCK} onChange={vi.fn()} />);
+
+    for (const label of ['Video URL', 'Thumbnail URL', 'Title link URL', 'Provider icon URL']) {
+      expect(input(label).getAttribute('aria-invalid')).toBeNull();
+    }
+  });
+
+  it.each([
+    ['Video URL', 'video_url'],
+    ['Thumbnail URL', 'thumbnail_url'],
+    ['Title link URL', 'title_url'],
+    ['Provider icon URL', 'provider_icon_url']
+  ])('marks %s invalid when it carries a javascript: URL', (label, key) => {
+    render(<BlockEditor block={{ ...VIDEO_BLOCK, [key]: 'javascript:alert(1)' }} onChange={vi.fn()} />);
+
+    expect(input(label).getAttribute('aria-invalid')).toBe('true');
+    expect(screen.getAllByText(/will be stripped before send and preview/).length).toBeGreaterThan(0);
+  });
+
+  // `video_url` lands in an `<iframe src>`, so it is held to http(s)
+  // only — stricter than the link allowlist the title link gets.
+  it('flags a mailto video URL but not a mailto title link', () => {
+    const { unmount } = render(
+      <BlockEditor block={{ ...VIDEO_BLOCK, video_url: 'mailto:a@b.com' }} onChange={vi.fn()} />
+    );
+    expect(input('Video URL').getAttribute('aria-invalid')).toBe('true');
+    unmount();
+
+    render(<BlockEditor block={{ ...VIDEO_BLOCK, title_url: 'mailto:a@b.com' }} onChange={vi.fn()} />);
+    expect(input('Title link URL').getAttribute('aria-invalid')).toBeNull();
+  });
+
+  it('clears the warning once the URL is corrected', () => {
+    const onChange = vi.fn();
+    const { rerender } = render(
+      <BlockEditor block={{ ...VIDEO_BLOCK, video_url: 'javascript:alert(1)' }} onChange={onChange} />
+    );
+    expect(input('Video URL').getAttribute('aria-invalid')).toBe('true');
+
+    fireEvent.change(input('Video URL'), { target: { value: 'https://vimeo.com/embed/1' } });
+    expect(onChange).toHaveBeenCalledWith({ ...VIDEO_BLOCK, video_url: 'https://vimeo.com/embed/1' });
+
+    rerender(<BlockEditor block={{ ...VIDEO_BLOCK, video_url: 'https://vimeo.com/embed/1' }} onChange={onChange} />);
+    expect(input('Video URL').getAttribute('aria-invalid')).toBeNull();
+  });
+
+  it('leaves an empty optional URL unflagged', () => {
+    render(<BlockEditor block={{ ...VIDEO_BLOCK, title_url: '' }} onChange={vi.fn()} />);
+
+    expect(input('Title link URL').getAttribute('aria-invalid')).toBeNull();
+    expect(screen.queryByText(/will be stripped before send and preview/)).toBeNull();
+  });
+});