From 8b610e0952a0b23134a581a5e8787d98bb693600 Mon Sep 17 00:00:00 2001 From: Abdullah Atta Date: Tue, 18 Aug 2026 09:15:32 +0500 Subject: [PATCH] cors: fix possible XSS vuln when embeding youtube-nocookie.com videos --- cors-proxy/src/index.ts | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/cors-proxy/src/index.ts b/cors-proxy/src/index.ts index 129e7eb..94b6c85 100644 --- a/cors-proxy/src/index.ts +++ b/cors-proxy/src/index.ts @@ -279,8 +279,8 @@ function serveYouTubeEmbed(url: string) { - `; @@ -299,6 +299,14 @@ function isYouTubeEmbed(urlString: string) { ); } +function escapeHtmlAttr(str: string): string { + return str + .replace(/&/g, "&") + .replace(/"/g, """) + .replace(//g, ">"); +} + // Transform YouTube URLs to use youtube-nocookie.com for enhanced privacy function transformYouTubeUrl(urlString: string): string { try { @@ -315,7 +323,7 @@ function transformYouTubeUrl(urlString: string): string { return url.toString(); } - return urlString; + return url.toString(); } catch { return urlString; }