From 87004a90023df2bf09c1bbfbde965f7b90a2bb91 Mon Sep 17 00:00:00 2001
From: miteruzo <miteruzo@naver.com>
Date: Thu, 1 Jan 2026 20:17:12 +0900
Subject: [PATCH] =?UTF-8?q?#157=20=E5=AF=BE=E5=BF=9C=E5=A4=96=E3=81=AE?=
 =?UTF-8?q?=E6=8A=95=E7=A8=BF=E3=82=92=20iframe=20=E3=81=A7=E5=9F=8B?=
 =?UTF-8?q?=E8=BE=BC=E3=82=80?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 frontend/src/components/PostEmbed.tsx | 27 +++++++++++++++++++++------
 1 file changed, 21 insertions(+), 6 deletions(-)

diff --git a/frontend/src/components/PostEmbed.tsx b/frontend/src/components/PostEmbed.tsx
index abb0fbe..f968789 100644
--- a/frontend/src/components/PostEmbed.tsx
+++ b/frontend/src/components/PostEmbed.tsx
@@ -1,3 +1,4 @@
+import { useState } from 'react'
 import YoutubeEmbed from 'react-youtube'
 
 import NicoViewer from '@/components/NicoViewer'
@@ -39,10 +40,24 @@ export default (({ post }: Props) => {
     }
   }
 
-  return (
-      <a href={post.url} target="_blank">
-	<img src={post.thumbnailBase || post.thumbnail}
-	     alt={post.url}
-	     className="mb-4 w-full"/>
-      </a>)
+  const [framed, setFramed] = useState (false)
+
+  return <>{
+      framed
+      ? (
+	  <iframe
+	      src={post.url}
+	      title={post.title || post.url}
+	      width={640}
+	      height={360}/>)
+      : (
+	  <a href="#" onClick={e => {
+	    e.preventDefault ()
+	    setFramed (confirm ('未確認の外部ページを表示します。\n'
+				+ '悪意のあるスクリプトが実行される可能性があります。\n'
+				+ '表示しますか?'))
+	    return
+	  }}>
+	    外部ページを表示
+	  </a>)}</>
 }) satisfies FC<Props>