# Embed tag src attribute prepends unsafe: in ember js

**URL:** <https://discuss.emberjs.com/t/embed-tag-src-attribute-prepends-unsafe-in-ember-js/11628>\
**Category:** Uncategorized\
**Created:** [September 21, 2016, 9:13pm UTC](https://discuss.emberjs.com/t/embed-tag-src-attribute-prepends-unsafe-in-ember-js/11628 "2016-09-21T21:13:16Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![webdo\_mane](https://avatars.discourse-cdn.com/v4/letter/w/4af34b/32.png) [@webdo\_mane](https://discuss.emberjs.com/u/webdo_mane)\
**Post date:** [September 21, 2016, 9:13pm UTC](https://discuss.emberjs.com/t/embed-tag-src-attribute-prepends-unsafe-in-ember-js/11628/1 "2016-09-21T21:13:16Z")

</div>

I am trying to use an embed tag and provided a dynamic url for the src attribute

```
<embed src="{{mediaUrl}}" type="{{mimeType}}" />

```

But when the page is opened I get

```
<embed src="unsafe:abc/def.mp4" type="video/mp4" />

```

- I changed permissions of CSP including media-src, child-src, etc
- I gave complete permissions(\*)
- I removed all permissions
- Finally I removed “ember-cli-content-security-policy” altogether even then the prepending of unsafe: could not be avoided.

Removing “ember-cli-content-security-policy” however did not block the url anymore but the url was still prepended with unsafe and because of which the video was not loaded

What else I tried:

- Used a ember component with tag as embed and src and type attribute-binded and used html.safestring. Result: unsafe: was still prepended

- Added the url to the src attribute after component was rendered(did not show video even though unsafe: was not prepended because I believe embed src tag cannot be changed)

- Added the entire after component was rended and now it worked.

But this is not something I want, I want it to be part of template and not inserted dynamically

---

<div class="post-metadata">

**Author:** ![rveitch](https://sea1.discourse-cdn.com/flex019/user_avatar/discuss.emberjs.com/rveitch/32/16455_2.png) [@rveitch](https://discuss.emberjs.com/u/rveitch)\
**Post date:** [May 1, 2019, 4:52pm UTC](https://discuss.emberjs.com/t/embed-tag-src-attribute-prepends-unsafe-in-ember-js/11628/2 "2019-05-01T16:52:59Z")

</div>

When you use `htmlSafe()` on the url, reference it in the template unquoted.

`<embed src={{mediaUrl}} type="{{mimeType}}"/>`