Embedded videos in articles autoplay even when configured not to - Known Error

Embedded videos in articles autoplay even when configured not to Description Autostart and autoplay attributes on a video embed element are stripped off even after adding them into the 'HTMLSanitizerConfig' Script Include and the 'HTMLSanitizerConfig' system property.

Steps to Reproduce

Modify the HTMLSanitizerConfig script include by adding the following: embed:{attribute:["src","type","allowfullscreen","allowscriptacces","plugnspage","autoplay","autostart"]}, object:{attribute:["classid","codebase"]}, param:{attribute:["name","value"]}

3. Embed a video from the [db_video] table using the edit/insert button in an article body HTML field.

4. Click the "source code" button (<>) on the TinyMCE toolbar. The generated code should look something like:

5. Add autoplay="false" to the embed tag.

6. Click the "ok" button.

7. Click again the "source code" button. Notice the generated code does not have the autoplay attribute. The TinyMCE editor is stripping out the autoplay attribute, so the video will start when loading the article, without manually starting it.

Workaround After carefully considering the severity and frequency of the issue, and the cost and risk of attempting a fix, it has been decided to not address this issue in any current or near future releases. We do not make these decisions lightly, and we apologize for any inconvenience.

When the property glide.ui.html.editor.extended_valid_elements is modifield to 'embed[src|type|height|width|allowfullscreen|allowscriptaccess|pluginspage|autoplay|autostart]' and the article body gets the autoplay attribute added, this is preserved in the source code rendering as autoplay="autoplay". It should be noted that autoplay is a boolean attribute, and even setting autoplay="false" would not be valid. The attribute would need to be entirely omitted to prevent autoplay. Ref.: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/video

Inspecting the article page source after clicking "View article", the tag is rendered into a tag that always has autoplay. This is UI code not part of the HTMLSanitizer, which does appear to be leaving the embed tags and attributes alone.