cors: fix possible XSS vuln when embeding youtube-nocookie.com videos

encryption verifier is used for verifying the encryption key during password resets. It can be any encrypted item.

Notesnook.API/Controllers/UsersController.cs

@@ -127,6 +127,24 @@ namespace Notesnook.API.Controllers
             }
         }
 
+
+        [HttpGet("verifier")]
+        public async Task<IActionResult> GetEncryptionVerifier()
+        {
+            var userId = User.GetUserId();
+            try
+            {
+                var response = await UserService.GetEncryptionVerifier(userId);
+                if (response == null) return NotFound();
+                return Ok(response);
+            }
+            catch (Exception ex)
+            {
+                logger.LogError(ex, "Failed to get encryption verifier for user id: {UserId}", userId);
+                return BadRequest(new { error = ex.Message });
+            }
+        }
+
         [HttpPost("reset")]
         public async Task<IActionResult> Reset([FromForm] bool removeAttachments)
         {

Notesnook.API/Interfaces/IUserService.cs

@@ -31,6 +31,7 @@ namespace Notesnook.API.Interfaces
         Task DeleteUserAsync(string userId, string? jti, string password);
         Task<bool> ResetUserAsync(string userId, bool removeAttachments);
         Task<UserResponse> GetUserAsync(string userId);
+        Task<EncryptedData?> GetEncryptionVerifier(string userId);
         Task SetUserKeysAsync(string userId, UserKeys keys);
     }
 }

Notesnook.API/Repositories/SyncItemsRepository.cs

@@ -36,6 +36,7 @@ using Streetwriters.Common;
 using Streetwriters.Data.DbContexts;
 using Streetwriters.Data.Interfaces;
 using Streetwriters.Data.Repositories;
+using AspNetCore.Identity.Mongo.Mongo;
 
 namespace Notesnook.API.Repositories
 {

Notesnook.API/Services/UserService.cs

@@ -30,6 +30,7 @@ using Notesnook.API.Helpers;
 using Notesnook.API.Interfaces;
 using Notesnook.API.Models;
 using Notesnook.API.Models.Responses;
+using Notesnook.API.Repositories;
 using Streetwriters.Common;
 using Streetwriters.Common.Accessors;
 using Streetwriters.Common.Enums;
@@ -192,6 +193,26 @@ namespace Notesnook.API.Services
             await Repositories.UsersSettings.UpdateAsync(userSettings.Id, userSettings);
         }
 
+        public async Task<EncryptedData?> GetEncryptionVerifier(string userId)
+        {
+            SyncItemsRepository[] repositories = [Repositories.Notes, Repositories.Notebooks, Repositories.Shortcuts, Repositories.Contents, Repositories.Settings, Repositories.LegacySettings, Repositories.Attachments, Repositories.Reminders, Repositories.Relations, Repositories.Colors, Repositories.Tags, Repositories.Vaults, Repositories.InboxItemsHistory];
+            foreach (var repo in repositories)
+            {
+                var item = await repo.FindOneAsync((s) => s.UserId == userId && (s.KeyVersion == null || s.KeyVersion == 0));
+                if (item != null)
+                {
+                    return new EncryptedData
+                    {
+                        Cipher = item.Cipher,
+                        IV = item.IV,
+                        Salt = "",
+                        Length = item.Length
+                    };
+                }
+            }
+            return null;
+        }
+
         public async Task DeleteUserAsync(string userId)
         {
             logger.LogInformation("Deleting user {UserId}", userId);

cors-proxy/src/index.ts

@@ -279,8 +279,8 @@ function serveYouTubeEmbed(url: string) {
     </style>
 </head>
 <body>
-    <iframe src="${transformYouTubeUrl(
-      url,
+    <iframe src="${escapeHtmlAttr(
+      transformYouTubeUrl(url),
     )}" allow="accelerometer;autoplay;clipboard-write;encrypted-media;gyroscope;picture-in-picture;web-share" allowfullscreen referrerpolicy="strict-origin-when-cross-origin" title="Video player"></iframe>
 </body>
 </html>`;
@@ -299,6 +299,14 @@ function isYouTubeEmbed(urlString: string) {
   );
 }
 
+function escapeHtmlAttr(str: string): string {
+  return str
+    .replace(/&/g, "&amp;")
+    .replace(/"/g, "&quot;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;");
+}
+
 // Transform YouTube URLs to use youtube-nocookie.com for enhanced privacy
 function transformYouTubeUrl(urlString: string): string {
   try {
@@ -315,7 +323,7 @@ function transformYouTubeUrl(urlString: string): string {
       return url.toString();
     }
 
-    return urlString;
+    return url.toString();
   } catch {
     return urlString;
   }