From 8f51f23d66d4eab997f622948f42612f49fada90 Mon Sep 17 00:00:00 2001
From: Anthony LC <anthony.le-courric@mail.numerique.gouv.fr>
Date: Thu, 9 Jul 2026 10:37:53 +0200
Subject: [PATCH 1/2] =?UTF-8?q?=E2=9C=A8(frontend)=20new=20custom=20block?=
 =?UTF-8?q?=20"embed"?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We introduce a new custom block called "embed" that
allows users to embed external content into their
documents. This block can be used to include
videos, interactive widgets, or other web content
directly within the document editor.
It is a powerfull custom block that can make
your document much more interactive.
---
 CHANGELOG.md                                  |   1 +
 .../__tests__/app-impress/doc-editor.spec.ts  |  50 ++++-
 .../doc-editor/components/BlockNoteEditor.tsx |  12 +-
 .../components/BlockNoteSuggestionMenu.tsx    |   2 +
 .../custom-blocks/CustomBlockStatus.tsx       |  43 ++++
 .../custom-blocks/DocsFilePanel.tsx           |  81 ++++++++
 .../components/custom-blocks/EmbedBlock.tsx   | 190 ++++++++++++++++++
 .../components/custom-blocks/PdfBlock.tsx     |  15 +-
 .../custom-blocks/UploadLoaderBlock.tsx       |  22 +-
 .../__tests__/EmbedBlock.test.ts              |  31 +++
 .../components/custom-blocks/index.ts         |   2 +
 .../features/docs/doc-export/mappingDocx.tsx  |   4 +-
 .../features/docs/doc-export/mappingODT.ts    |   4 +-
 .../features/docs/doc-export/mappingPDF.tsx   |   4 +-
 .../features/docs/doc-export/utils_print.ts   |  14 +-
 15 files changed, 439 insertions(+), 36 deletions(-)
 create mode 100644 src/frontend/apps/impress/src/features/docs/doc-editor/components/custom-blocks/CustomBlockStatus.tsx
 create mode 100644 src/frontend/apps/impress/src/features/docs/doc-editor/components/custom-blocks/DocsFilePanel.tsx
 create mode 100644 src/frontend/apps/impress/src/features/docs/doc-editor/components/custom-blocks/EmbedBlock.tsx
 create mode 100644 src/frontend/apps/impress/src/features/docs/doc-editor/components/custom-blocks/__tests__/EmbedBlock.test.ts

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2aafeb4ab4..d4516c8c25 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,7 @@ and this project adheres to
 
 ### Added
 
+- ✨(frontend) new custom block "embed" #2513
 - ♿️(frontend) restore skip to content link after header redesign #2510
 
 ## [v5.4.1] - 2026-07-09
diff --git a/src/frontend/apps/e2e/__tests__/app-impress/doc-editor.spec.ts b/src/frontend/apps/e2e/__tests__/app-impress/doc-editor.spec.ts
index 0524167227..8b9afa11d1 100644
--- a/src/frontend/apps/e2e/__tests__/app-impress/doc-editor.spec.ts
+++ b/src/frontend/apps/e2e/__tests__/app-impress/doc-editor.spec.ts
@@ -544,7 +544,7 @@ test.describe('Doc Editor', () => {
   });
 
   test('it embeds PDF', async ({ page, browserName }) => {
-    await createDoc(page, 'doc-toolbar', browserName, 1);
+    await createDoc(page, 'doc-embed-pdf', browserName, 1);
 
     await page.getByRole('button', { name: 'Share' }).click();
     await updateShareLink(page, 'Public', 'Reading');
@@ -637,4 +637,52 @@ test.describe('Doc Editor', () => {
 
     await expect(editor.getByText('Mobile Text')).toBeVisible();
   });
+
+  test('it embeds a web page', async ({ page, browserName }) => {
+    await createDoc(page, 'doc-embed-web', browserName, 1);
+
+    await openSuggestionMenu({ page, suggestion: 'Embed a web page' });
+
+    const embedBlock = page.locator('div[data-content-type="embed"]').last();
+
+    await expect(embedBlock).toBeVisible();
+
+    // Try with same domain first
+    await page
+      .getByText(/Add embed/)
+      .first()
+      .click();
+
+    await page
+      .locator('[data-test="embed-input"]')
+      .fill('http://localhost:3000/');
+
+    await page.locator('[data-test="embed-input-button"]').click();
+
+    await expect(page.getByText('Invalid or unsafe URL.')).toBeVisible();
+
+    await openSuggestionMenu({ page, suggestion: 'Embed a web page' });
+
+    // Now with a valid URL
+    await page
+      .getByText(/Add embed/)
+      .first()
+      .click();
+
+    await page
+      .locator('[data-test="embed-input"]')
+      .fill('http://127.0.0.1:3000/');
+    await page.locator('[data-test="embed-input-button"]').click();
+
+    const embedIframe = page
+      .locator('.--docs--editor-container iframe.bn-visual-media')
+      .first();
+
+    // Check src of embed iframe
+    expect(await embedIframe.getAttribute('src')).toMatch(
+      /http:\/\/127.0.0.1:3000\//,
+    );
+
+    await expect(embedIframe).toHaveAttribute('role', 'presentation');
+  });
 });
diff --git a/src/frontend/apps/impress/src/features/docs/doc-editor/components/BlockNoteEditor.tsx b/src/frontend/apps/impress/src/features/docs/doc-editor/components/BlockNoteEditor.tsx
index 5c9b2b1e29..7e4681ee89 100644
--- a/src/frontend/apps/impress/src/features/docs/doc-editor/components/BlockNoteEditor.tsx
+++ b/src/frontend/apps/impress/src/features/docs/doc-editor/components/BlockNoteEditor.tsx
@@ -12,6 +12,7 @@ import * as localesBN from '@blocknote/core/locales';
 import { BlockNoteView } from '@blocknote/mantine';
 import '@blocknote/mantine/style.css';
 import {
+  FilePanelController,
   FloatingComposerController,
   FloatingThreadController,
   ThreadsSidebar,
@@ -53,7 +54,13 @@ import { randomColor, sanitizeColor } from '../utils';
 import BlockNoteAI from './AI';
 import { BlockNoteSuggestionMenu } from './BlockNoteSuggestionMenu';
 import { BlockNoteToolbar } from './BlockNoteToolBar/BlockNoteToolbar';
-import { CalloutBlock, PdfBlock, UploadLoaderBlock } from './custom-blocks';
+import {
+  CalloutBlock,
+  DocsFilePanel,
+  EmbedBlock,
+  PdfBlock,
+  UploadLoaderBlock,
+} from './custom-blocks';
 const AIMenu = BlockNoteAI?.AIMenu;
 const AIMenuController = BlockNoteAI?.AIMenuController;
 const useAI = BlockNoteAI?.useAI;
@@ -70,6 +77,7 @@ const baseBlockNoteSchema = withPageBreak(
       ...defaultBlockSpecs,
       callout: CalloutBlock(),
       codeBlock: createCodeBlockSpec(codeBlockOptions),
+      embed: EmbedBlock(),
       pdf: PdfBlock(),
       uploadLoader: UploadLoaderBlock(),
     },
@@ -292,6 +300,7 @@ export const BlockNoteEditor = ({ doc, provider }: BlockNoteEditorProps) => {
         editor={editor}
         formattingToolbar={false}
         slashMenu={false}
+        filePanel={false}
         theme="light"
         comments={false}
         aria-label={t('Document editor')}
@@ -303,6 +312,7 @@ export const BlockNoteEditor = ({ doc, provider }: BlockNoteEditorProps) => {
         )}
         <BlockNoteSuggestionMenu aiAllowed={aiBlockNoteAllowed} />
         <BlockNoteToolbar aiAllowed={aiBlockNoteAllowed} />
+        <FilePanelController filePanel={DocsFilePanel} />
         {showComments && <FloatingComposerController />}
         {showComments && !isCommentSideBarOpen && <FloatingThreadController />}
         {threadsSidebarTarget &&
diff --git a/src/frontend/apps/impress/src/features/docs/doc-editor/components/BlockNoteSuggestionMenu.tsx b/src/frontend/apps/impress/src/features/docs/doc-editor/components/BlockNoteSuggestionMenu.tsx
index 805377f691..24127e00b5 100644
--- a/src/frontend/apps/impress/src/features/docs/doc-editor/components/BlockNoteSuggestionMenu.tsx
+++ b/src/frontend/apps/impress/src/features/docs/doc-editor/components/BlockNoteSuggestionMenu.tsx
@@ -20,6 +20,7 @@ import {
 import BlockNoteAI from './AI';
 import {
   getCalloutReactSlashMenuItems,
+  getEmbedReactSlashMenuItems,
   getPdfReactSlashMenuItems,
 } from './custom-blocks';
 import { useGetInterlinkingMenuItems } from './custom-inline-content';
@@ -56,6 +57,7 @@ export const BlockNoteSuggestionMenu = ({
       getPageBreakReactSlashMenuItems(editor),
       getMultiColumnSlashMenuItems?.(editor) || [],
       getPdfReactSlashMenuItems(editor, t, fileBlocksName),
+      getEmbedReactSlashMenuItems(editor, t, fileBlocksName),
       getCalloutReactSlashMenuItems(editor, t, basicBlocksName),
       aiAllowed && getAISlashMenuItems ? getAISlashMenuItems(editor) : [],
     );
diff --git a/src/frontend/apps/impress/src/features/docs/doc-editor/components/custom-blocks/CustomBlockStatus.tsx b/src/frontend/apps/impress/src/features/docs/doc-editor/components/custom-blocks/CustomBlockStatus.tsx
new file mode 100644
index 0000000000..fa8646874e
--- /dev/null
+++ b/src/frontend/apps/impress/src/features/docs/doc-editor/components/custom-blocks/CustomBlockStatus.tsx
@@ -0,0 +1,43 @@
+import { Box, BoxType, Icon } from '@/components';
+
+import Loader from '../../assets/loader.svg';
+import Warning from '../../assets/warning.svg';
+
+interface CustomBlockStatusProps extends BoxType {
+  type?: 'loading' | 'warning';
+}
+
+export const CustomBlockStatus = ({
+  type = 'warning',
+  children,
+  ...props
+}: CustomBlockStatusProps) => {
+  return (
+    <Box
+      $direction="row"
+      $gap="0.5rem"
+      $width="inherit"
+      $css="pointer-events: none;"
+      contentEditable={false}
+      draggable={false}
+      {...props}
+    >
+      {type === 'warning' ? (
+        <Warning style={{ flexShrink: 0 }} aria-hidden="true" />
+      ) : (
+        <Icon
+          $theme="brand"
+          $layer="border"
+          icon={
+            <Loader
+              style={{ animation: 'spin 1.5s linear infinite' }}
+              aria-hidden="true"
+            />
+          }
+          $shrink={0}
+        />
+      )}
+      {children}
+    </Box>
+  );
+};
diff --git a/src/frontend/apps/impress/src/features/docs/doc-editor/components/custom-blocks/DocsFilePanel.tsx b/src/frontend/apps/impress/src/features/docs/doc-editor/components/custom-blocks/DocsFilePanel.tsx
new file mode 100644
index 0000000000..6c694c9fb0
--- /dev/null
+++ b/src/frontend/apps/impress/src/features/docs/doc-editor/components/custom-blocks/DocsFilePanel.tsx
@@ -0,0 +1,81 @@
+/**
+ * Copy of Blocknote's default FilePanel, restricted to hide the "Upload" tab
+ * for blocks whose props explicitly set `uploadDisabled: true` (e.g. the
+ * "embed" block, which only supports embedding an existing URL).
+ *
+ * Original source:
+ * https://github.com/TypeCellOS/BlockNote/blob/main/packages/react/src/components/FilePanel/FilePanel.tsx
+ */
+import {
+  EmbedTab,
+  FilePanelProps,
+  UploadTab,
+  useBlockNoteEditor,
+  useComponentsContext,
+  useDictionary,
+} from '@blocknote/react';
+import { useState } from 'react';
+
+import {
+  DocsBlockSchema,
+  DocsInlineContentSchema,
+  DocsStyleSchema,
+} from '../../types';
+
+export const DocsFilePanel = (
+  props: FilePanelProps & Partial<{ defaultOpenTab: string }>,
+) => {
+  const Components = useComponentsContext();
+  const dict = useDictionary();
+
+  const editor = useBlockNoteEditor<
+    DocsBlockSchema,
+    DocsInlineContentSchema,
+    DocsStyleSchema
+  >();
+
+  const [loading, setLoading] = useState<boolean>(false);
+
+  const block = editor.getBlock(props.blockId);
+  const uploadDisabled =
+    !!block &&
+    'uploadDisabled' in block.props &&
+    block.props.uploadDisabled === true;
+  const allowUpload = editor.uploadFile !== undefined && !uploadDisabled;
+
+  const tabs = [
+    ...(allowUpload
+      ? [
+          {
+            name: dict.file_panel.upload.title,
+            tabPanel: (
+              <UploadTab blockId={props.blockId} setLoading={setLoading} />
+            ),
+          },
+        ]
+      : []),
+    {
+      name: dict.file_panel.embed.title,
+      tabPanel: <EmbedTab blockId={props.blockId} />,
+    },
+  ];
+
+  const [openTab, setOpenTab] = useState<string>(
+    props.defaultOpenTab || tabs[0].name,
+  );
+
+  if (!Components) {
+    return null;
+  }
+
+  return (
+    <Components.FilePanel.Root
+      className="bn-panel"
+      defaultOpenTab={openTab}
+      openTab={openTab}
+      setOpenTab={setOpenTab}
+      tabs={tabs}
+      loading={loading}
+    />
+  );
+};
diff --git a/src/frontend/apps/impress/src/features/docs/doc-editor/components/custom-blocks/EmbedBlock.tsx b/src/frontend/apps/impress/src/features/docs/doc-editor/components/custom-blocks/EmbedBlock.tsx
new file mode 100644
index 0000000000..b63515bdb4
--- /dev/null
+++ b/src/frontend/apps/impress/src/features/docs/doc-editor/components/custom-blocks/EmbedBlock.tsx
@@ -0,0 +1,190 @@
+/**
+ * EmbedBlock — embeds an external web page in a document via a sandboxed
+ * `<iframe>`. The URL is stored in the collaborative document and rendered on
+ * every member's machine, so it is treated as untrusted content.
+ *
+ * ⚠️ To keep it secure, the block enforces two invariants:
+ * 1. The URL must be safe (https, no javascript: or data:).
+ * 2. The URL must be cross-origin (not same-origin with the app).
+ *
+ * Two layers keep it cross-origin, where the
+ * Same-Origin Policy blocks parent access:
+ *   1. `isSameOriginUrl` rejects same-origin URLs on every render (re-checked
+ *      per viewer, not just at insert time).
+ *   2. `X-Frame-Options: DENY` (nginx) and `frame-ancestors 'none'` (backend
+ *      CSP) stop the embed redirecting its frame back into the app origin.
+ *
+ * When editing, keep these invariants: don't weaken `isSameOriginUrl`; keep the
+ * anti-framing headers on every same-origin route.
+ */
+
+import {
+  BlockConfig,
+  BlockNoDefaults,
+  BlockNoteEditor,
+  InlineContentSchema,
+  StyleSchema,
+} from '@blocknote/core';
+import { insertOrUpdateBlockForSlashMenu } from '@blocknote/core/extensions';
+import * as locales from '@blocknote/core/locales';
+import {
+  AddFileButton,
+  ResizableFileBlockWrapper,
+  createReactBlockSpec,
+} from '@blocknote/react';
+import { TFunction } from 'i18next';
+import { useEffect } from 'react';
+import { useTranslation } from 'react-i18next';
+import { createGlobalStyle } from 'styled-components';
+
+import { Box, Icon } from '@/components';
+import { isSafeUrl } from '@/utils/url';
+
+import { DocsBlockNoteEditor } from '../../types';
+
+import { CustomBlockStatus } from './CustomBlockStatus';
+
+const EmbedBlockStyle = createGlobalStyle`
+  .bn-block-content[data-content-type="embed"] .bn-file-block-content-wrapper {
+    width: fit-content;
+  }
+  .bn-block-content[data-content-type="embed"] .bn-file-block-content-wrapper[style*="fit-content"] {
+    width: 100% !important;
+  }
+`;
+
+type FileBlockEditor = Parameters<typeof AddFileButton>[0]['editor'];
+type FileBlockBlock = Parameters<typeof AddFileButton>[0]['block'];
+
+export const isSameOriginUrl = (url: string): boolean => {
+  try {
+    return (
+      new URL(url, window.location.origin).origin === window.location.origin
+    );
+  } catch {
+    return true;
+  }
+};
+
+type CreateEmbedBlockConfig = BlockConfig<
+  'embed',
+  {
+    backgroundColor: { default: 'default' };
+    caption: { default: '' };
+    name: { default: '' };
+    previewWidth: { default: undefined; type: 'number' };
+    showPreview: { default: true };
+    textAlignment: { default: 'left' };
+    uploadDisabled: { default: true };
+    url: { default: '' };
+  },
+  'none'
+>;
+
+interface EmbedBlockComponentProps {
+  block: BlockNoDefaults<
+    Record<'embed', CreateEmbedBlockConfig>,
+    InlineContentSchema,
+    StyleSchema
+  >;
+  editor: BlockNoteEditor<
+    Record<'embed', CreateEmbedBlockConfig>,
+    InlineContentSchema,
+    StyleSchema
+  >;
+}
+
+const EmbedBlockComponent = ({ editor, block }: EmbedBlockComponentProps) => {
+  const embedUrl = block.props.url;
+  const { i18n, t } = useTranslation();
+  const lang = i18n.resolvedLanguage;
+
+  useEffect(() => {
+    if (lang && locales[lang as keyof typeof locales]) {
+      locales[lang as keyof typeof locales].file_blocks.add_button_text[
+        'embed'
+      ] = t('Add embed');
+      (
+        locales[lang as keyof typeof locales].file_panel.embed
+          .embed_button as Record<string, string>
+      )['embed'] = t('Embed');
+    }
+  }, [lang, t]);
+
+  const isInvalidEmbed =
+    !!embedUrl && (!isSafeUrl(embedUrl) || isSameOriginUrl(embedUrl));
+
+  if (isInvalidEmbed) {
+    return <CustomBlockStatus>{t('Invalid or unsafe URL.')}</CustomBlockStatus>;
+  }
+
+  return (
+    <>
+      <EmbedBlockStyle />
+      <ResizableFileBlockWrapper
+        buttonIcon={
+          <Icon iconName="public" $size="24px" $css="line-height: normal;" />
+        }
+        block={block as unknown as FileBlockBlock}
+        editor={editor as unknown as FileBlockEditor}
+      >
+        {!!embedUrl && (
+          <Box
+            as="iframe"
+            className="bn-visual-media"
+            role="presentation"
+            $width="100%"
+            $height="450px"
+            src={embedUrl}
+            title={block.props.name || t('Embedded content')}
+            sandbox="allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox allow-forms"
+            referrerPolicy="no-referrer"
+            loading="lazy"
+            contentEditable={false}
+            draggable={false}
+          />
+        )}
+      </ResizableFileBlockWrapper>
+    </>
+  );
+};
+
+export const EmbedBlock = createReactBlockSpec(
+  {
+    type: 'embed',
+    content: 'none',
+    propSchema: {
+      backgroundColor: { default: 'default' as const },
+      caption: { default: '' as const },
+      name: { default: '' as const },
+      previewWidth: { default: undefined, type: 'number' },
+      showPreview: { default: true },
+      textAlignment: { default: 'left' as const },
+      uploadDisabled: { default: true },
+      url: { default: '' as const },
+    },
+  },
+  {
+    meta: {
+      fileBlockAccept: [],
+    },
+    render: (props) => <EmbedBlockComponent {...props} />,
+  },
+);
+
+export const getEmbedReactSlashMenuItems = (
+  editor: DocsBlockNoteEditor,
+  t: TFunction<'translation', undefined>,
+  group: string,
+) => [
+  {
+    title: t('Embed'),
+    onItemClick: () => {
+      insertOrUpdateBlockForSlashMenu(editor, { type: 'embed' });
+    },
+    aliases: [t('embed'), t('iframe'), t('website'), t('link')],
+    group,
+    icon: <Icon iconName="public" $size="18px" />,
+    subtext: t('Embed a web page'),
+  },
+];
diff --git a/src/frontend/apps/impress/src/features/docs/doc-editor/components/custom-blocks/PdfBlock.tsx b/src/frontend/apps/impress/src/features/docs/doc-editor/components/custom-blocks/PdfBlock.tsx
index 596a44b164..aecd4a4b5f 100644
--- a/src/frontend/apps/impress/src/features/docs/doc-editor/components/custom-blocks/PdfBlock.tsx
+++ b/src/frontend/apps/impress/src/features/docs/doc-editor/components/custom-blocks/PdfBlock.tsx
@@ -20,10 +20,11 @@ import { createGlobalStyle } from 'styled-components';
 import { Box, Icon, Loading } from '@/components';
 import { isSafeUrl } from '@/utils/url';
 
-import Warning from '../../assets/warning.svg';
 import { ANALYZE_URL } from '../../conf';
 import { DocsBlockNoteEditor } from '../../types';
 
+import { CustomBlockStatus } from './CustomBlockStatus';
+
 const PDFBlockStyle = createGlobalStyle`
   .bn-block-content[data-content-type="pdf"] .bn-file-block-content-wrapper {
     width: fit-content;
@@ -120,17 +121,7 @@ const PdfBlockComponent = ({ editor, block }: PdfBlockComponentProps) => {
 
   if (isInvalidPDF) {
     return (
-      <Box
-        $direction="row"
-        $gap="0.5rem"
-        $width="inherit"
-        $css="pointer-events: none;"
-        contentEditable={false}
-        draggable={false}
-      >
-        <Warning />
-        {t('Invalid or missing PDF file.')}
-      </Box>
+      <CustomBlockStatus>{t('Invalid or missing PDF file.')}</CustomBlockStatus>
     );
   }
 
diff --git a/src/frontend/apps/impress/src/features/docs/doc-editor/components/custom-blocks/UploadLoaderBlock.tsx b/src/frontend/apps/impress/src/features/docs/doc-editor/components/custom-blocks/UploadLoaderBlock.tsx
index dc81107b97..5de3e988d5 100644
--- a/src/frontend/apps/impress/src/features/docs/doc-editor/components/custom-blocks/UploadLoaderBlock.tsx
+++ b/src/frontend/apps/impress/src/features/docs/doc-editor/components/custom-blocks/UploadLoaderBlock.tsx
@@ -9,13 +9,13 @@ import { createReactBlockSpec } from '@blocknote/react';
 import { t } from 'i18next';
 import { useEffect } from 'react';
 
-import { Box, Icon, Text } from '@/components';
+import { Text } from '@/components';
 import { useMediaUrl } from '@/core';
 import { isSafeUrl } from '@/utils/url';
 
 import { loopCheckDocMediaStatus } from '../../api';
-import Loader from '../../assets/loader.svg';
-import Warning from '../../assets/warning.svg';
+
+import { CustomBlockStatus } from './CustomBlockStatus';
 
 type UploadLoaderPropSchema = {
   readonly information: { readonly default: '' };
@@ -130,18 +130,12 @@ const UploadLoaderBlockComponent = ({
   }, [block, editor, mediaUrl, isEditable]);
 
   return (
-    <Box className="bn-visual-media-wrapper" $direction="row" $gap="0.5rem">
-      {block.props.type === 'warning' ? (
-        <Warning />
-      ) : (
-        <Icon
-          $theme="brand"
-          $layer="border"
-          icon={<Loader style={{ animation: 'spin 1.5s linear infinite' }} />}
-        />
-      )}
+    <CustomBlockStatus
+      className="bn-visual-media-wrapper"
+      type={block.props.type}
+    >
       <Text>{block.props.information}</Text>
-    </Box>
+    </CustomBlockStatus>
   );
 };
 
diff --git a/src/frontend/apps/impress/src/features/docs/doc-editor/components/custom-blocks/__tests__/EmbedBlock.test.ts b/src/frontend/apps/impress/src/features/docs/doc-editor/components/custom-blocks/__tests__/EmbedBlock.test.ts
new file mode 100644
index 0000000000..5c1e82e1e2
--- /dev/null
+++ b/src/frontend/apps/impress/src/features/docs/doc-editor/components/custom-blocks/__tests__/EmbedBlock.test.ts
@@ -0,0 +1,31 @@
+import { describe, expect, it } from 'vitest';
+
+import { isSameOriginUrl } from '../EmbedBlock';
+
+describe('EmbedBlock', () => {
+  describe('isSameOriginUrl', () => {
+    it('returns true for a URL with the same origin as the app', () => {
+      expect(isSameOriginUrl(window.location.origin + '/some/path')).toBe(true);
+    });
+
+    it('returns true for a relative URL (resolves to same origin)', () => {
+      expect(isSameOriginUrl('/relative/path')).toBe(true);
+    });
+
+    it('returns false for a cross-origin https URL', () => {
+      expect(isSameOriginUrl('https://example.com/page')).toBe(false);
+    });
+
+    it('returns false for a cross-origin URL with a different subdomain', () => {
+      expect(isSameOriginUrl('https://sub.example.com/')).toBe(false);
+    });
+
+    it('returns false for a cross-origin URL on a different port', () => {
+      expect(isSameOriginUrl('https://localhost:9999/')).toBe(false);
+    });
+
+    it('returns true for an unparseable URL (treated as unsafe)', () => {
+      expect(isSameOriginUrl('not a valid url %%')).toBe(true);
+    });
+  });
+});
diff --git a/src/frontend/apps/impress/src/features/docs/doc-editor/components/custom-blocks/index.ts b/src/frontend/apps/impress/src/features/docs/doc-editor/components/custom-blocks/index.ts
index e9276a7afa..9e525ba434 100644
--- a/src/frontend/apps/impress/src/features/docs/doc-editor/components/custom-blocks/index.ts
+++ b/src/frontend/apps/impress/src/features/docs/doc-editor/components/custom-blocks/index.ts
@@ -1,3 +1,5 @@
 export * from './CalloutBlock';
+export * from './DocsFilePanel';
+export * from './EmbedBlock';
 export * from './PdfBlock';
 export * from './UploadLoaderBlock';
diff --git a/src/frontend/apps/impress/src/features/docs/doc-export/mappingDocx.tsx b/src/frontend/apps/impress/src/features/docs/doc-export/mappingDocx.tsx
index dc8afc2f47..1619abc5e9 100644
--- a/src/frontend/apps/impress/src/features/docs/doc-export/mappingDocx.tsx
+++ b/src/frontend/apps/impress/src/features/docs/doc-export/mappingDocx.tsx
@@ -14,10 +14,12 @@ export const docxDocsSchemaMappings: DocsExporterDocx['mappings'] = {
   blockMapping: {
     ...docxDefaultSchemaMappings.blockMapping,
     callout: blockMappingCalloutDocx,
-    // We're reusing the file block mapping for PDF blocks; both share the same
+    // We're reusing the file block mapping for PDF/embed blocks; both share the same
     // implementation signature, so we can reuse the handler directly.
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     pdf: docxDefaultSchemaMappings.blockMapping.file as any,
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    embed: docxDefaultSchemaMappings.blockMapping.file as any,
     quote: blockMappingQuoteDocx,
     image: blockMappingImageDocx,
     uploadLoader: blockMappingUploadLoaderDocx,
diff --git a/src/frontend/apps/impress/src/features/docs/doc-export/mappingODT.ts b/src/frontend/apps/impress/src/features/docs/doc-export/mappingODT.ts
index ea37c7420c..53af6e7396 100644
--- a/src/frontend/apps/impress/src/features/docs/doc-export/mappingODT.ts
+++ b/src/frontend/apps/impress/src/features/docs/doc-export/mappingODT.ts
@@ -18,10 +18,12 @@ export const odtDocsSchemaMappings: DocsExporterODT['mappings'] = {
     ...odtDefaultSchemaMappings.blockMapping,
     callout: blockMappingCalloutODT,
     image: blockMappingImageODT,
-    // We're reusing the file block mapping for PDF blocks
+    // We're reusing the file block mapping for PDF/embed blocks
     // The types don't match exactly but the implementation is compatible
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     pdf: odtDefaultSchemaMappings.blockMapping.file as any,
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    embed: odtDefaultSchemaMappings.blockMapping.file as any,
     uploadLoader: blockMappingUploadLoaderODT,
   },
 
diff --git a/src/frontend/apps/impress/src/features/docs/doc-export/mappingPDF.tsx b/src/frontend/apps/impress/src/features/docs/doc-export/mappingPDF.tsx
index 1431715d6f..69dcea9cd6 100644
--- a/src/frontend/apps/impress/src/features/docs/doc-export/mappingPDF.tsx
+++ b/src/frontend/apps/impress/src/features/docs/doc-export/mappingPDF.tsx
@@ -22,10 +22,12 @@ export const pdfDocsSchemaMappings: DocsExporterPDF['mappings'] = {
     paragraph: blockMappingParagraphPDF,
     quote: blockMappingQuotePDF,
     table: blockMappingTablePDF,
-    // We're using the file block mapping for PDF blocks
+    // We're using the file block mapping for PDF/embed blocks
     // The types don't match exactly but the implementation is compatible
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     pdf: pdfDefaultSchemaMappings.blockMapping.file as any,
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    embed: pdfDefaultSchemaMappings.blockMapping.file as any,
     uploadLoader: blockMappingUploadLoaderPDF,
   },
   inlineContentMapping: {
diff --git a/src/frontend/apps/impress/src/features/docs/doc-export/utils_print.ts b/src/frontend/apps/impress/src/features/docs/doc-export/utils_print.ts
index 82a5ef65c4..e9c46feaa9 100644
--- a/src/frontend/apps/impress/src/features/docs/doc-export/utils_print.ts
+++ b/src/frontend/apps/impress/src/features/docs/doc-export/utils_print.ts
@@ -101,8 +101,9 @@ const PRINT_ONLY_CONTENT_CSS = `
 
   /* Hide media/embed placeholders and render their URLs */
   [data-content-type="file"] .bn-file-block-content-wrapper, 
-  [data-content-type="pdf"] .bn-file-block-content-wrapper, 
-  [data-content-type="audio"] .bn-file-block-content-wrapper, 
+  [data-content-type="pdf"] .bn-file-block-content-wrapper,
+  [data-content-type="embed"] .bn-file-block-content-wrapper,
+  [data-content-type="audio"] .bn-file-block-content-wrapper,
   [data-content-type="video"] .bn-file-block-content-wrapper {
     display: none !important;
   }
@@ -182,7 +183,7 @@ function wrapMediaWithLink() {
     el: Element,
     url: string | null,
     name: string | null,
-    type: 'file' | 'audio' | 'video' | 'pdf',
+    type: 'file' | 'audio' | 'video' | 'pdf' | 'embed',
   ) => {
     if (!url || !isSafeUrl(url)) {
       return;
@@ -201,6 +202,8 @@ function wrapMediaWithLink() {
       label.textContent = '📹: ';
     } else if (type === 'pdf') {
       label.textContent = '📑: ';
+    } else if (type === 'embed') {
+      label.textContent = '🌐: ';
     } else {
       label.textContent = '🔗: ';
     }
@@ -224,7 +227,7 @@ function wrapMediaWithLink() {
 
   document
     .querySelectorAll(
-      '[data-content-type="pdf"], [data-content-type="file"], [data-content-type="audio"], [data-content-type="video"]',
+      '[data-content-type="pdf"], [data-content-type="embed"], [data-content-type="file"], [data-content-type="audio"], [data-content-type="video"]',
     )
     .forEach((el) => {
       const url = el?.getAttribute('data-url');
@@ -233,7 +236,8 @@ function wrapMediaWithLink() {
         | 'file'
         | 'audio'
         | 'video'
-        | 'pdf';
+        | 'pdf'
+        | 'embed';
       if (type) {
         prependLink(el, url, name, type);
       }

From 76dd9c1dd3eef173006644d00f26fc5bfc8bad70 Mon Sep 17 00:00:00 2001
From: Anthony LC <anthony.le-courric@mail.numerique.gouv.fr>
Date: Fri, 10 Jul 2026 15:50:42 +0200
Subject: [PATCH 2/2] =?UTF-8?q?=F0=9F=94=92=EF=B8=8F(settings)=20add=20set?=
 =?UTF-8?q?tings=20for=20the=20embed=20block?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We added 2 settings for the embed block:
- FRONTEND_EMBED_BLOCK_ENABLED: to enable or disable
  the embed block in the editor
- FRONTEND_EMBED_BLOCK_ALLOWED_ORIGINS: to define a
  list of allowed origins for the embed block, and
  the associated sandbox attributes (allow-scripts,
  allow-same-origin, etc.)
This will allow to control the usage of the embed
block in the editor, and to restrict the origins
that can be embedded.
---
 documentation/env.md                          |   2 +
 src/backend/core/api/viewsets.py              |   2 +
 src/backend/core/tests/test_api_config.py     |   8 +
 src/backend/impress/settings.py               |  22 +++
 .../__tests__/app-impress/doc-editor.spec.ts  |  94 +++++++++++-
 .../e2e/__tests__/app-impress/utils-common.ts |   4 +
 .../impress/src/core/config/api/useConfig.tsx |  13 ++
 .../components/BlockNoteSuggestionMenu.tsx    |   8 +-
 .../components/custom-blocks/EmbedBlock.tsx   | 101 ++++++++++++-
 .../__tests__/EmbedBlock.test.ts              | 139 +++++++++++++++++-
 10 files changed, 382 insertions(+), 11 deletions(-)

diff --git a/documentation/env.md b/documentation/env.md
index 6da1e30e86..78946940c9 100644
--- a/documentation/env.md
+++ b/documentation/env.md
@@ -80,6 +80,8 @@ These are the environment variables you can set for the `impress-backend` contai
 | FRONTEND_CSS_URL                                | To add a external css file to the app                                                                                                                                      |                                                                         |
 | FRONTEND_JS_URL                                 | To add a external js file to the app                                                                                                                                       |                                                                         |
 | FRONTEND_HOMEPAGE_FEATURE_ENABLED               | Frontend feature flag to display the homepage                                                                                                                              | false                                                                   |
+| FRONTEND_EMBED_BLOCK_ENABLED                    | Frontend feature flag to allow inserting the "embed" block                                                                                                                 | true                                                                    |
+| FRONTEND_EMBED_BLOCK_ALLOWED_ORIGINS            | Allowlist mapping each embeddable host to its iframe sandbox, e.g. `{"excalidraw.com": "allow-scripts allow-same-origin"}`. Each key matches only that exact host; prefix with `*.` to also cover its subdomains, or use a bare `*` to allow any host | {"*": "allow-scripts allow-same-origin"}                               |
 | FRONTEND_THEME                                  | Frontend theme to use                                                                                                                                                      |                                                                         |
 | LANGUAGE_CODE                                   | Default language                                                                                                                                                           | en-us                                                                   |
 | LANGFUSE_SECRET_KEY                             | The Langfuse secret key used by the sdk                                                                                                                                    | None                                                                    |
diff --git a/src/backend/core/api/viewsets.py b/src/backend/core/api/viewsets.py
index 5d9991bcbf..eca09edd4e 100644
--- a/src/backend/core/api/viewsets.py
+++ b/src/backend/core/api/viewsets.py
@@ -3087,6 +3087,8 @@ def get(self, request):
             "CONVERSION_UPLOAD_ENABLED",
             "ENVIRONMENT",
             "FRONTEND_CSS_URL",
+            "FRONTEND_EMBED_BLOCK_ENABLED",
+            "FRONTEND_EMBED_BLOCK_ALLOWED_ORIGINS",
             "FRONTEND_HOMEPAGE_FEATURE_ENABLED",
             "FRONTEND_JS_URL",
             "FRONTEND_SILENT_LOGIN_ENABLED",
diff --git a/src/backend/core/tests/test_api_config.py b/src/backend/core/tests/test_api_config.py
index 5f7fef4536..4138e5a0ae 100644
--- a/src/backend/core/tests/test_api_config.py
+++ b/src/backend/core/tests/test_api_config.py
@@ -29,6 +29,10 @@
     COLLABORATION_WS_INACTIVITY_TIMEOUT=300,
     CONVERSION_UPLOAD_ENABLED=False,
     FRONTEND_CSS_URL="http://testcss/",
+    FRONTEND_EMBED_BLOCK_ENABLED=True,
+    FRONTEND_EMBED_BLOCK_ALLOWED_ORIGINS={
+        "excalidraw.com": "allow-scripts allow-same-origin",
+    },
     FRONTEND_JS_URL="http://testjs/",
     FRONTEND_THEME="test-theme",
     MEDIA_BASE_URL="http://testserver/",
@@ -63,6 +67,10 @@ def test_api_config(is_authenticated):
         "CONVERSION_UPLOAD_ENABLED": False,
         "ENVIRONMENT": "test",
         "FRONTEND_CSS_URL": "http://testcss/",
+        "FRONTEND_EMBED_BLOCK_ENABLED": True,
+        "FRONTEND_EMBED_BLOCK_ALLOWED_ORIGINS": {
+            "excalidraw.com": "allow-scripts allow-same-origin",
+        },
         "FRONTEND_HOMEPAGE_FEATURE_ENABLED": True,
         "FRONTEND_JS_URL": "http://testjs/",
         "FRONTEND_SILENT_LOGIN_ENABLED": False,
diff --git a/src/backend/impress/settings.py b/src/backend/impress/settings.py
index 7c94fb9f53..d5072aa980 100755
--- a/src/backend/impress/settings.py
+++ b/src/backend/impress/settings.py
@@ -554,6 +554,28 @@ class Base(Configuration):
     FRONTEND_SILENT_LOGIN_ENABLED = values.BooleanValue(
         default=False, environ_name="FRONTEND_SILENT_LOGIN_ENABLED", environ_prefix=None
     )
+    FRONTEND_EMBED_BLOCK_ENABLED = values.BooleanValue(
+        default=True, environ_name="FRONTEND_EMBED_BLOCK_ENABLED", environ_prefix=None
+    )
+    # Allowlist of origins that may be embedded through the "embed" custom block,
+    # mapping each allowed host to the sandbox attribute to apply to its iframe.
+    # A URL whose host is not covered here is refused by the frontend.
+    # Example:
+    #  {
+    #    "grist.numerique.gouv.fr": "allow-scripts",
+    #    "*.numerique.gouv.fr": "allow-scripts allow-same-origin",
+    #  }
+    FRONTEND_EMBED_BLOCK_ALLOWED_ORIGINS = values.DictValue(
+        default={
+            "*": (
+                "allow-scripts allow-same-origin allow-popups "
+                "allow-popups-to-escape-sandbox allow-forms"
+            )
+        },
+        environ_name="FRONTEND_EMBED_BLOCK_ALLOWED_ORIGINS",
+        environ_prefix=None,
+    )
+
     THEME_CUSTOMIZATION_FILE_PATH = values.Value(
         os.path.join(BASE_DIR, "impress/configuration/theme/default.json"),
         environ_name="THEME_CUSTOMIZATION_FILE_PATH",
diff --git a/src/frontend/apps/e2e/__tests__/app-impress/doc-editor.spec.ts b/src/frontend/apps/e2e/__tests__/app-impress/doc-editor.spec.ts
index 8b9afa11d1..bbec001213 100644
--- a/src/frontend/apps/e2e/__tests__/app-impress/doc-editor.spec.ts
+++ b/src/frontend/apps/e2e/__tests__/app-impress/doc-editor.spec.ts
@@ -3,8 +3,18 @@ import path from 'path';
 import { expect, test } from '@playwright/test';
 import cs from 'convert-stream';
 
-import { createDoc, goToGridDoc, verifyDocName } from './utils-common';
-import { getEditor, openSuggestionMenu, writeInEditor } from './utils-editor';
+import {
+  createDoc,
+  goToGridDoc,
+  overrideConfig,
+  verifyDocName,
+} from './utils-common';
+import {
+  getEditor,
+  openSuggestionMenu,
+  tryFocusEditorContent,
+  writeInEditor,
+} from './utils-editor';
 import { updateShareLink } from './utils-share';
 import {
   createRootSubPage,
@@ -671,7 +681,7 @@ test.describe('Doc Editor', () => {
 
     await page
       .locator('[data-test="embed-input"]')
-      .fill('http://127.0.0.1:3000/');
+      .fill('http://localhost:3001/');
     await page.locator('[data-test="embed-input-button"]').click();
 
     const embedIframe = page
@@ -680,9 +690,85 @@ test.describe('Doc Editor', () => {
 
     // Check src of embed iframe
     expect(await embedIframe.getAttribute('src')).toMatch(
-      /http:\/\/127.0.0.1:3000\//,
+      /http:\/\/localhost:3001\//,
     );
 
     await expect(embedIframe).toHaveAttribute('role', 'presentation');
   });
+
+  test('it controls the embeds of a web page with configuration', async ({
+    page,
+    browserName,
+  }) => {
+    // Disable the embed block feature to test the configuration
+    await overrideConfig(page, {
+      FRONTEND_EMBED_BLOCK_ENABLED: false,
+    });
+
+    await createDoc(page, 'doc-embed-web-configuration', browserName, 1);
+
+    await tryFocusEditorContent({ page });
+    await page.keyboard.press('Enter');
+    await page.keyboard.type('/');
+
+    await expect(
+      page.locator('.bn-suggestion-menu').getByText('Embed a web page'),
+    ).toBeHidden();
+
+    await overrideConfig(page, {
+      FRONTEND_EMBED_BLOCK_ALLOWED_ORIGINS: {
+        'http://localhost:3001': 'allow-scripts',
+      },
+    });
+
+    await page.reload();
+
+    await openSuggestionMenu({ page, suggestion: 'Embed a web page' });
+
+    const embedBlock = page.locator('div[data-content-type="embed"]').last();
+
+    await expect(embedBlock).toBeVisible();
+
+    // Try with a domain that is not allowed first
+    await page
+      .getByText(/Add embed/)
+      .first()
+      .click();
+
+    await page
+      .locator('[data-test="embed-input"]')
+      .fill('http://localhost:3002/');
+
+    await page.locator('[data-test="embed-input-button"]').click();
+
+    await expect(
+      page.getByText(
+        'This domain is not allowed for embedding. Please contact your administrator to have it added to the list of allowed domains.',
+      ),
+    ).toBeVisible();
+
+    await openSuggestionMenu({ page, suggestion: 'Embed a web page' });
+
+    // Now with a valid URL
+    await page
+      .getByText(/Add embed/)
+      .first()
+      .click();
+
+    await page
+      .locator('[data-test="embed-input"]')
+      .fill('http://localhost:3001/');
+    await page.locator('[data-test="embed-input-button"]').click();
+
+    const embedIframe = page
+      .locator('.--docs--editor-container iframe.bn-visual-media')
+      .first();
+
+    // Check src of embed iframe
+    expect(await embedIframe.getAttribute('src')).toMatch(
+      /http:\/\/localhost:3001\//,
+    );
+    await expect(embedIframe).toHaveAttribute('sandbox', 'allow-scripts');
+    await expect(embedIframe).toHaveAttribute('role', 'presentation');
+  });
 });
diff --git a/src/frontend/apps/e2e/__tests__/app-impress/utils-common.ts b/src/frontend/apps/e2e/__tests__/app-impress/utils-common.ts
index b42785719e..2c32649446 100644
--- a/src/frontend/apps/e2e/__tests__/app-impress/utils-common.ts
+++ b/src/frontend/apps/e2e/__tests__/app-impress/utils-common.ts
@@ -25,6 +25,10 @@ export const CONFIG = {
   CONVERSION_FILE_EXTENSIONS_ALLOWED: ['.docx', '.md'],
   CONVERSION_FILE_MAX_SIZE: 20971520,
   ENVIRONMENT: 'development',
+  FRONTEND_EMBED_BLOCK_ENABLED: true,
+  FRONTEND_EMBED_BLOCK_ALLOWED_ORIGINS: {
+    '*': 'allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox allow-forms',
+  },
   FRONTEND_CSS_URL: null,
   FRONTEND_JS_URL: null,
   FRONTEND_HOMEPAGE_FEATURE_ENABLED: true,
diff --git a/src/frontend/apps/impress/src/core/config/api/useConfig.tsx b/src/frontend/apps/impress/src/core/config/api/useConfig.tsx
index b204e5a381..45018acbfe 100644
--- a/src/frontend/apps/impress/src/core/config/api/useConfig.tsx
+++ b/src/frontend/apps/impress/src/core/config/api/useConfig.tsx
@@ -42,6 +42,17 @@ interface ThemeCustomization {
   waffle?: LaGaufreV2Props;
 }
 
+/**
+ * Map of an allowed embed host to the iframe `sandbox` attribute to apply.
+ * Record<host, sandboxAttribute>
+ * Example:
+ * {
+ *   "excalidraw.com": "allow-scripts allow-same-origin",
+ *   "www.tldraw.com": "allow-scripts allow-same-origin",
+ * }
+ */
+export type EmbedAllowedOrigins = Record<string, string>;
+
 export interface ConfigResponse {
   AI_BOT: { name: string; color: string };
   AI_FEATURE_ENABLED?: boolean;
@@ -56,6 +67,8 @@ export interface ConfigResponse {
   CONVERSION_UPLOAD_ENABLED?: boolean;
   ENVIRONMENT: string;
   FRONTEND_CSS_URL?: string;
+  FRONTEND_EMBED_BLOCK_ENABLED?: boolean;
+  FRONTEND_EMBED_BLOCK_ALLOWED_ORIGINS?: EmbedAllowedOrigins;
   FRONTEND_HOMEPAGE_FEATURE_ENABLED?: boolean;
   FRONTEND_JS_URL?: string;
   FRONTEND_SILENT_LOGIN_ENABLED?: boolean;
diff --git a/src/frontend/apps/impress/src/features/docs/doc-editor/components/BlockNoteSuggestionMenu.tsx b/src/frontend/apps/impress/src/features/docs/doc-editor/components/BlockNoteSuggestionMenu.tsx
index 24127e00b5..4e59c7ac7e 100644
--- a/src/frontend/apps/impress/src/features/docs/doc-editor/components/BlockNoteSuggestionMenu.tsx
+++ b/src/frontend/apps/impress/src/features/docs/doc-editor/components/BlockNoteSuggestionMenu.tsx
@@ -11,6 +11,8 @@ import {
 import React, { useMemo } from 'react';
 import { useTranslation } from 'react-i18next';
 
+import { useConfig } from '@/core';
+
 import {
   DocsBlockSchema,
   DocsInlineContentSchema,
@@ -45,6 +47,7 @@ export const BlockNoteSuggestionMenu = ({
   const dictionaryDate = useDictionary();
   const basicBlocksName = dictionaryDate.slash_menu.page_break.group;
   const fileBlocksName = dictionaryDate.slash_menu.file.group;
+  const embedEnabled = useConfig().data?.FRONTEND_EMBED_BLOCK_ENABLED ?? false;
 
   const getInterlinkingMenuItems = useGetInterlinkingMenuItems();
 
@@ -57,7 +60,9 @@ export const BlockNoteSuggestionMenu = ({
       getPageBreakReactSlashMenuItems(editor),
       getMultiColumnSlashMenuItems?.(editor) || [],
       getPdfReactSlashMenuItems(editor, t, fileBlocksName),
-      getEmbedReactSlashMenuItems(editor, t, fileBlocksName),
+      embedEnabled
+        ? getEmbedReactSlashMenuItems(editor, t, fileBlocksName)
+        : [],
       getCalloutReactSlashMenuItems(editor, t, basicBlocksName),
       aiAllowed && getAISlashMenuItems ? getAISlashMenuItems(editor) : [],
     );
@@ -82,6 +87,7 @@ export const BlockNoteSuggestionMenu = ({
     fileBlocksName,
     basicBlocksName,
     aiAllowed,
+    embedEnabled,
     getInterlinkingMenuItems,
   ]);
 
diff --git a/src/frontend/apps/impress/src/features/docs/doc-editor/components/custom-blocks/EmbedBlock.tsx b/src/frontend/apps/impress/src/features/docs/doc-editor/components/custom-blocks/EmbedBlock.tsx
index b63515bdb4..c99019b31f 100644
--- a/src/frontend/apps/impress/src/features/docs/doc-editor/components/custom-blocks/EmbedBlock.tsx
+++ b/src/frontend/apps/impress/src/features/docs/doc-editor/components/custom-blocks/EmbedBlock.tsx
@@ -3,9 +3,14 @@
  * `<iframe>`. The URL is stored in the collaborative document and rendered on
  * every member's machine, so it is treated as untrusted content.
  *
- * ⚠️ To keep it secure, the block enforces two invariants:
+ * ⚠️ To keep it secure, the block enforces three invariants:
  * 1. The URL must be safe (https, no javascript: or data:).
  * 2. The URL must be cross-origin (not same-origin with the app).
+ * 3. The URL's host must be explicitly allowlisted server-side
+ *    (FRONTEND_EMBED_BLOCK_ALLOWED_ORIGINS). Each allowlist entry also carries
+ *    the `sandbox` applied to its iframe, so an embed only gets the
+ *    capabilities the administrator granted to that origin. A host that is not
+ *    listed is refused, and the user is invited to ask an administrator.
  *
  * Two layers keep it cross-origin, where the
  * Same-Origin Policy blocks parent access:
@@ -38,6 +43,7 @@ import { useTranslation } from 'react-i18next';
 import { createGlobalStyle } from 'styled-components';
 
 import { Box, Icon } from '@/components';
+import { EmbedAllowedOrigins, useConfig } from '@/core';
 import { isSafeUrl } from '@/utils/url';
 
 import { DocsBlockNoteEditor } from '../../types';
@@ -66,6 +72,74 @@ export const isSameOriginUrl = (url: string): boolean => {
   }
 };
 
+/**
+ * Returns the `sandbox` to apply for a URL, or `undefined` when the host is not
+ * covered by the configured origins.
+ *
+ * Entry formats (port is always significant):
+ *  - `"example.com"` — exact host, default port only
+ *  - `"example.com:8080"` — exact host, specific port
+ *  - `"*.example.com"` — all subdomains, default port only
+ *  - `"*.example.com:8080"` — all subdomains, specific port
+ *  - `"*"` — catch-all (any host/port)
+ *
+ * Priority: exact host > longest `"*."` wildcard > `"*"` catch-all.
+ * See `matchEmbedOrigin` tests for concrete examples (`./__tests__/EmbedBlock.test.ts`).
+ */
+export const matchEmbedOrigin = (
+  url: string,
+  allowedOrigins: EmbedAllowedOrigins,
+): string | undefined => {
+  let host: string;
+  try {
+    host = new URL(url, window.location.origin).host.toLowerCase();
+  } catch {
+    return undefined;
+  }
+
+  let bestWildcardMatch: { baseHost: string; sandbox: string } | undefined;
+  let catchAllSandbox: string | undefined;
+
+  for (const [origin, sandbox] of Object.entries(allowedOrigins)) {
+    let allowedHost = origin.trim().toLowerCase();
+    if (allowedHost === '*') {
+      catchAllSandbox = sandbox;
+      continue;
+    }
+
+    if (allowedHost.includes('://')) {
+      try {
+        allowedHost = new URL(allowedHost).host;
+      } catch {
+        continue;
+      }
+    } else {
+      allowedHost = allowedHost.split('/')[0];
+    }
+
+    const isWildcard = allowedHost.startsWith('*.');
+    const baseHost = isWildcard ? allowedHost.slice(2) : allowedHost;
+    if (!baseHost) {
+      continue;
+    }
+
+    if (!isWildcard && host === baseHost) {
+      return sandbox;
+    }
+
+    if (
+      isWildcard &&
+      host.endsWith(`.${baseHost}`) &&
+      (!bestWildcardMatch ||
+        baseHost.length > bestWildcardMatch.baseHost.length)
+    ) {
+      bestWildcardMatch = { baseHost, sandbox };
+    }
+  }
+
+  return bestWildcardMatch?.sandbox ?? catchAllSandbox;
+};
+
 type CreateEmbedBlockConfig = BlockConfig<
   'embed',
   {
@@ -111,13 +185,32 @@ const EmbedBlockComponent = ({ editor, block }: EmbedBlockComponentProps) => {
     }
   }, [lang, t]);
 
-  const isInvalidEmbed =
+  const conf = useConfig().data;
+  const allowedOrigins = conf?.FRONTEND_EMBED_BLOCK_ALLOWED_ORIGINS ?? {};
+
+  const isUnsafeEmbed =
     !!embedUrl && (!isSafeUrl(embedUrl) || isSameOriginUrl(embedUrl));
+  const sandbox =
+    !!embedUrl && !isUnsafeEmbed
+      ? matchEmbedOrigin(embedUrl, allowedOrigins)
+      : undefined;
+  const isDisallowedEmbed =
+    !!embedUrl && !isUnsafeEmbed && sandbox === undefined;
 
-  if (isInvalidEmbed) {
+  if (isUnsafeEmbed) {
     return <CustomBlockStatus>{t('Invalid or unsafe URL.')}</CustomBlockStatus>;
   }
 
+  if (isDisallowedEmbed) {
+    return (
+      <CustomBlockStatus>
+        {t(
+          'This domain is not allowed for embedding. Please contact your administrator to have it added to the list of allowed domains.',
+        )}
+      </CustomBlockStatus>
+    );
+  }
+
   return (
     <>
       <EmbedBlockStyle />
@@ -137,7 +230,7 @@ const EmbedBlockComponent = ({ editor, block }: EmbedBlockComponentProps) => {
             $height="450px"
             src={embedUrl}
             title={block.props.name || t('Embedded content')}
-            sandbox="allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox allow-forms"
+            sandbox={sandbox ?? ''}
             referrerPolicy="no-referrer"
             loading="lazy"
             contentEditable={false}
diff --git a/src/frontend/apps/impress/src/features/docs/doc-editor/components/custom-blocks/__tests__/EmbedBlock.test.ts b/src/frontend/apps/impress/src/features/docs/doc-editor/components/custom-blocks/__tests__/EmbedBlock.test.ts
index 5c1e82e1e2..3a932935eb 100644
--- a/src/frontend/apps/impress/src/features/docs/doc-editor/components/custom-blocks/__tests__/EmbedBlock.test.ts
+++ b/src/frontend/apps/impress/src/features/docs/doc-editor/components/custom-blocks/__tests__/EmbedBlock.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, it } from 'vitest';
 
-import { isSameOriginUrl } from '../EmbedBlock';
+import { isSameOriginUrl, matchEmbedOrigin } from '../EmbedBlock';
 
 describe('EmbedBlock', () => {
   describe('isSameOriginUrl', () => {
@@ -24,8 +24,143 @@ describe('EmbedBlock', () => {
       expect(isSameOriginUrl('https://localhost:9999/')).toBe(false);
     });
 
-    it('returns true for an unparseable URL (treated as unsafe)', () => {
+    it('returns true for an unparsable URL (treated as unsafe)', () => {
       expect(isSameOriginUrl('not a valid url %%')).toBe(true);
     });
   });
+
+  describe('matchEmbedOrigin', () => {
+    it('returns the sandbox for an exact host match', () => {
+      expect(
+        matchEmbedOrigin('https://example.com/page', {
+          'example.com': 'allow-scripts',
+        }),
+      ).toBe('allow-scripts');
+    });
+
+    it('returns undefined when the host is not in the allowlist', () => {
+      expect(
+        matchEmbedOrigin('https://example.com/', {
+          'other.com': 'allow-scripts',
+        }),
+      ).toBeUndefined();
+    });
+
+    it('matches a wildcard entry for a subdomain', () => {
+      expect(
+        matchEmbedOrigin('https://docs.numerique.gouv.fr/', {
+          '*.numerique.gouv.fr': 'allow-scripts allow-same-origin',
+        }),
+      ).toBe('allow-scripts allow-same-origin');
+    });
+
+    it('does not match the bare base host with a wildcard entry', () => {
+      expect(
+        matchEmbedOrigin('https://numerique.gouv.fr/', {
+          '*.numerique.gouv.fr': 'allow-scripts',
+        }),
+      ).toBeUndefined();
+    });
+
+    it('prefers an exact host match over a wildcard match', () => {
+      expect(
+        matchEmbedOrigin('https://grist.numerique.gouv.fr/', {
+          '*.numerique.gouv.fr': 'allow-scripts',
+          'grist.numerique.gouv.fr': 'allow-scripts allow-forms',
+        }),
+      ).toBe('allow-scripts allow-forms');
+    });
+
+    it('prefers the longest wildcard match when multiple wildcards match', () => {
+      expect(
+        matchEmbedOrigin('https://a.b.example.com/', {
+          '*.example.com': 'sandbox-a',
+          '*.b.example.com': 'sandbox-b',
+        }),
+      ).toBe('sandbox-b');
+    });
+
+    it('matches the catch-all "*" entry when no other entry matches', () => {
+      expect(
+        matchEmbedOrigin('https://anything.example.com/', {
+          '*': 'allow-scripts',
+        }),
+      ).toBe('allow-scripts');
+    });
+
+    it('prefers any specific match over the catch-all "*"', () => {
+      expect(
+        matchEmbedOrigin('https://example.com/', {
+          '*': 'allow-scripts',
+          'example.com': 'allow-scripts allow-forms',
+        }),
+      ).toBe('allow-scripts allow-forms');
+    });
+
+    it('accepts origin entries written as full URLs and extracts the hostname', () => {
+      expect(
+        matchEmbedOrigin('https://example.com/page', {
+          'https://example.com/': 'allow-scripts',
+        }),
+      ).toBe('allow-scripts');
+    });
+
+    it('returns undefined for an unparsable URL', () => {
+      expect(
+        matchEmbedOrigin('not a valid url %%', {
+          'example.com': 'allow-scripts',
+        }),
+      ).toBeUndefined();
+    });
+
+    it('returns undefined for an empty allowlist', () => {
+      expect(matchEmbedOrigin('https://example.com/', {})).toBeUndefined();
+    });
+
+    it('does NOT match an exact host entry when the URL has a different port', () => {
+      expect(
+        matchEmbedOrigin('https://example.com:8080/page', {
+          'example.com': 'allow-scripts',
+        }),
+      ).toBeUndefined();
+    });
+
+    it('matches an exact host entry when the allowlist entry includes the same port', () => {
+      expect(
+        matchEmbedOrigin('https://example.com:8080/page', {
+          'example.com:8080': 'allow-scripts',
+        }),
+      ).toBe('allow-scripts');
+    });
+
+    it('does NOT match a wildcard entry when the URL has a different port', () => {
+      expect(
+        matchEmbedOrigin('https://sub.example.com:8443/', {
+          '*.example.com': 'allow-scripts',
+        }),
+      ).toBeUndefined();
+    });
+
+    it('matches a wildcard entry that includes the same port', () => {
+      expect(
+        matchEmbedOrigin('https://sub.example.com:8443/', {
+          '*.example.com:8443': 'allow-scripts',
+        }),
+      ).toBe('allow-scripts');
+    });
+
+    it('matches the catch-all "*" entry for a URL with a non-standard port', () => {
+      expect(
+        matchEmbedOrigin('https://example.com:3000/', { '*': 'allow-scripts' }),
+      ).toBe('allow-scripts');
+    });
+
+    it('allows any https URL and returns the default sandbox', () => {
+      expect(
+        matchEmbedOrigin('https://example.com/', {
+          '*': 'allow-scripts',
+        }),
+      ).toBe('allow-scripts');
+    });
+  });
 });