title: Meteor.js embed iframe safely
body: <p>I have a meteor.js app which contains a chat. We need to allow users post embed code from youtube and soundcloud. Safely.</p>
  
  <p>I use djedi:sanitize-html-client to sanitize user inputs other than the ones containing "youtube" and "soundcloud.com"</p>
  
  <p>So, for YouTube, I got it working where I take that user input string, for example </p>
  
  <p><div class="snippet" data-lang="js" data-hide="false">
  <div class="snippet-code">
  <pre class="snippet-code-html lang-html prettyprint-override"><code>&lt;iframe width="560" height="315" src="https://www.youtube.com/embed/B65pLsah3XE" frameborder="0" allowfullscreen&gt;&lt;/iframe&gt;</code></pre>
  </div>
  </div>
  </p>
  
  <p>, then split it on space, and loop through the array to find a valid url using this RegEx: </p>
  
  <p><div class="snippet" data-lang="js" data-hide="false">
  <div class="snippet-code">
  <pre class="snippet-code-js lang-js prettyprint-override"><code>var pattern = new RegExp("(http|ftp|https)://[\w-]+(\.[\w-]+)+([\w.,@?^=%&amp;amp;:/~+#-]*[\w@?^=%&amp;amp;/~+#-])?");</code></pre>
  </div>
  </div>
  </p>
  
  <p>After that, if a valid url was found, I reconstruct iframe html in code, insert into Mongo per usual, and it's displayed in the chat window. This part is working.</p>
  
  <p>But this approach does not work for soundcloud embed code, example:</p>
  
  <p><div class="snippet" data-lang="js" data-hide="false">
  <div class="snippet-code">
  <pre class="snippet-code-html lang-html prettyprint-override"><code>&lt;iframe width="100%" height="450" scrolling="no" frameborder="no" src="https://w.soundcloud.com/player/?url=https%3A//api.soundcloud.com/tracks/227010461&amp;amp;auto_play=false&amp;amp;hide_related=false&amp;amp;show_comments=true&amp;amp;show_user=true&amp;amp;show_reposts=false&amp;amp;visual=true"&gt;&lt;/iframe&gt;</code></pre>
  </div>
  </div>
  </p>
  
  <p>RegEx does not find the match in that soundcloud iframe code.</p>
  
  <p>So, my question is: How do I either RegEx these two urls from soundcloud embed html, or is there a safe way in Meteor.js to allow embeding iframe.</p>