fix(extension-youtube) change regex to disallow non-youtube domains

ueberdosis · Nov 20, 2023 · 1bd714a · 1bd714a
1 parent 7debf2b
commit 1bd714a
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/packages/extension-youtube/src/utils.ts b/packages/extension-youtube/src/utils.ts
@@ -1,5 +1,5 @@
-export const YOUTUBE_REGEX = /^(https?:\/\/)?(www\.|music\.)?(youtube\.com|youtu\.be)(?!.*\/channel\/)(?!\/@)(.+)?$/
-export const YOUTUBE_REGEX_GLOBAL = /^(https?:\/\/)?(www\.|music\.)?(youtube\.com|youtu\.be)(?!.*\/channel\/)(?!\/@)(.+)?$/g
+export const YOUTUBE_REGEX = /^(https?:\/\/)?(www\.|music\.)?(youtube\.com|youtu\.be)\/(?!channel\/)(?!@)(.+)?$/
+export const YOUTUBE_REGEX_GLOBAL = /^(https?:\/\/)?(www\.|music\.)?(youtube\.com|youtu\.be)\/(?!channel\/)(?!@)(.+)?$/g
 
 export const isValidYoutubeUrl = (url: string) => {
   return url.match(YOUTUBE_REGEX)

diff --git a/tests/cypress/integration/extensions/youtube.spec.ts b/tests/cypress/integration/extensions/youtube.spec.ts
@@ -25,6 +25,7 @@ describe('extension-youtube', () => {
     // eslint-disable-next-line no-script-url
     'javascript:alert(window.origin)//embed/',
     'https://youtube.google.com/embed/fdsafsdf',
+    'https://youtube.com.bad/embed'
   ]
 
   invalidUrls.forEach(url => {