Fix: Secure YouTube hostname validation

apps/chrome-extension/src/entrypoints/background.ts

@@ -396,7 +396,7 @@ function isYouTubeWatchUrl(value: string | null | undefined): boolean {
       const id = url.pathname.replace(/^\/+/, "").trim();
       return Boolean(id);
     }
-    if (!host.endsWith("youtube.com")) return false;
+    if (host !== "youtube.com" && !host.endsWith(".youtube.com")) return false;
     const path = url.pathname.toLowerCase();
     if (path === "/watch") return Boolean(url.searchParams.get("v")?.trim());
     if (path.startsWith("/shorts/")) return true;

packages/core/src/content/url.ts

@@ -4,7 +4,7 @@ import { isTwitterBroadcastUrl, isTwitterStatusUrl } from "./link-preview/conten
 export const isYouTubeUrl = (rawUrl: string): boolean => {
   try {
     const hostname = new URL(rawUrl).hostname.toLowerCase();
-    return hostname.includes("youtube.com") || hostname.includes("youtu.be");
+    return hostname === "youtube.com" || hostname.endsWith(".youtube.com") || hostname === "youtu.be";
   } catch {
     const lower = rawUrl.toLowerCase();
     return lower.includes("youtube.com") || lower.includes("youtu.be");
@@ -48,7 +48,7 @@ export function isYouTubeVideoUrl(rawUrl: string): boolean {
       return Boolean(url.pathname.split("/").filter(Boolean)[0]);
     }
 
-    if (!hostname.includes("youtube.com")) {
+    if (hostname !== "youtube.com" && !hostname.endsWith(".youtube.com")) {
       return false;
     }
 
@@ -75,7 +75,7 @@ export function extractYouTubeVideoId(rawUrl: string): string | null {
     if (hostname === "youtu.be") {
       candidate = url.pathname.split("/")[1] ?? null;
     }
-    if (hostname.includes("youtube.com")) {
+    if (hostname === "youtube.com" || hostname.endsWith(".youtube.com")) {
       if (url.pathname.startsWith("/watch")) {
         candidate = url.searchParams.get("v");
       } else if (url.pathname.startsWith("/shorts/")) {

tests/content.url.test.ts

@@ -78,4 +78,17 @@ describe("content/url", () => {
     );
     expect(shouldPreferUrlMode("https://example.com/article")).toBe(false);
   });
+
+  it("should not be bypassed by malicious YouTube-like hostnames", () => {
+    const malicious = [
+      "https://attacker-youtube.com/watch?v=dQw4w9WgXcQ",
+      "https://notyoutube.com/watch?v=dQw4w9WgXcQ",
+      "https://youtube.com.attacker.com/watch?v=dQw4w9WgXcQ",
+    ];
+    for (const url of malicious) {
+      expect(isYouTubeUrl(url)).toBe(false);
+      expect(isYouTubeVideoUrl(url)).toBe(false);
+      expect(extractYouTubeVideoId(url)).toBeNull();
+    }
+  });
 });