CalvinBackup/notesnook-sync-server_customPrivateV1
1
0
Fork 0
mirror of https://github.com/streetwriters/notesnook-sync-server.git synced 2026-08-18 06:17:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

cors: fix possible XSS vuln when embeding youtube-nocookie.com videos

Browse Source
This commit is contained in:
Abdullah Atta
2026-08-18 09:15:32 +05:00
parent 0a3ee07b95
commit 8b610e0952
1 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cors-proxy/src/index.ts
+11 -3
View File
@@ -279,8 +279,8 @@ function serveYouTubeEmbed(url: string) {
</style>
</head>
<body>
<iframe src="${transformYouTubeUrl(
url,
<iframe src="${escapeHtmlAttr(
transformYouTubeUrl(url),
)}" allow="accelerometer;autoplay;clipboard-write;encrypted-media;gyroscope;picture-in-picture;web-share" allowfullscreen referrerpolicy="strict-origin-when-cross-origin" title="Video player"></iframe>
</body>
</html>`;
@@ -299,6 +299,14 @@ function isYouTubeEmbed(urlString: string) {
);
}
function escapeHtmlAttr(str: string): string {
return str
.replace(/&/g, "&amp;")
.replace(/"/g, "&quot;")
.replace(/</g, "&lt;")
.replace(/>/g, "&gt;");
}
// Transform YouTube URLs to use youtube-nocookie.com for enhanced privacy
function transformYouTubeUrl(urlString: string): string {
try {
@@ -315,7 +323,7 @@ function transformYouTubeUrl(urlString: string): string {
return url.toString();
}
return urlString;
return url.toString();
} catch {
return urlString;
}