Question

I have following config in my antisamy policy file:

Old YouTube Object:

<object width="1280" height="720">
<param 
    name="movie" 
    value="http://www.youtube.com/v/Hl-zzrqQoSE
           ?version=3
           &amp;hl=en_US
           &amp;rel=0">
</param>
<param name="allowFullScreen" value="true">
</param>
<param name="allowscriptaccess" value="always">
</param>
<embed src="http://www.youtube.com/v/Hl-zzrqQoSE
            ?version=3
            &amp;hl=en_US
            &amp;rel=0" 
       type="application/x-shockwave-flash" 
       width="1280" 
       height="720" 
       allowscriptaccess="always" 
       allowfullscreen="true">
 </embed>
 </object>

The AntiSamy config:

 <common-regexps>
     <regexp name="YouTubeURL" value="(\s)*(http(s?)://)www.youtube.com/v/[\p{L}\p{N}]+[\p{L}\p{N}\p{Zs}\.\#@\$%\+&amp;;:\-_~,\?=/!]*(\s)*"/>
 ....

<!-- Tags related to YouTube -->
<tag name="object" action="validate">
<attribute name="height"/>
<attribute name="width"/>
<attribute name="type">
    <literal-list>
        <literal value="application/x-shockwave-flash"/>
    </literal-list>
</attribute>
<attribute name="data">
    <regexp-list>
        <regexp name="YouTubeURL"/>
    </regexp-list>
</attribute>
</tag>
<tag name="embed" action="validate">
<attribute name="height"/>
<attribute name="width"/>
<attribute name="type">
    <literal-list>
        <literal value="application/x-shockwave-flash"/>
    </literal-list>
</attribute>
<attribute name="allowfullscreen">
    <regexp-list>
        <regexp name="boolean"/>
    </regexp-list>
</attribute>
<attribute name="allowscriptaccess">
    <literal-list>
        <literal value="always"/>
    </literal-list>
</attribute>
<attribute name="src">
    <regexp-list>
        <regexp name="YouTubeURL"/>
    </regexp-list>
</attribute>
<attribute name="movie">
    <regexp-list>
        <regexp name="YouTubeURL"/>
    </regexp-list>
</attribute>
</tag>

Currently my config on iframe:

    <!-- Frame & related tags -->

    <tag name="iframe" action="remove"/>
    <tag name="frameset" action="remove"/>
    <tag name="frame" action="remove"/>

The new YouTube iframe:

<iframe 
    width="1280" 
    height="720" 
    <!--   src="https://www.youtube-nocookie.com/embed/Hl-zzrqQoSE"  -->
    src="https://www.youtube.com/embed/Hl-zzrqQoSE" 
    frameborder="0" 
    allowfullscreen>
</iframe>

I figure the code for iframe should like this:

<tag name="iframe" action="validate">
        <attribute name="height"/>
        <attribute name="width"/>
        <attribute name="frameborder"/>
        <attribute name="src">
            <regexp-list>
                <regexp name="YouTubeURL"/>
            </regexp-list>
        </attribute>

        <attribute name="allowfullscreen">
            <regexp-list>
                <regexp name="boolean"/>
            </regexp-list>
        </attribute>
</tag>

How do you change the regex so it will accept the old and new links like:

    https://www.youtube-nocookie.com/embed/Hl-zzrqQoSE
    
    
    http://www.youtube-nocookie.com/v/Hl-zzrqQoSE?version=3&hl=en_US&rel=0
    http://www.youtube.com/v/Hl-zzrqQoSE?version=3&hl=en_US&rel=0"

Answer 1

\s*(https?://)www.youtube(-nocookie)?.com/(?:v|embed)/[\p{L}\p{N}]+[\p{L}\p{N}\p{Zs}.#@$%+&;:_~,?=!/-]*\s*

I took the liberty to remove unnecessary capture groups, escapes and characters.

Although I personally would use something like:

\s*(https?://www.youtube(?:-nocookie)?.com/(?:v|embed)/([a-zA-Z0-9-]+).*)

That puts the entire youtube URL in match group 0 and the video id in match group 1.
Also it doesn’t make a whole lot of sense to use unicode properties when youtube’s URLs don’t contain unicode characters.

Demo: http://rubular.com/r/jv4zO9ys2L