From 88645938822bba231323df2dac2ab170ce50e81e Mon Sep 17 00:00:00 2001 From: tzhangchi Date: Wed, 17 Aug 2022 10:14:34 +0800 Subject: [PATCH] fix(youtube): Incomplete URL substring sanitization --- .../src/components/source-view/format-url/youtube.ts | 3 ++- ! | 0 2 files changed, 2 insertions(+), 1 deletion(-) create mode 100644 ! diff --git a/libs/components/editor-blocks/src/components/source-view/format-url/youtube.ts b/libs/components/editor-blocks/src/components/source-view/format-url/youtube.ts index ebc0c70be0..202f0dc968 100644 --- a/libs/components/editor-blocks/src/components/source-view/format-url/youtube.ts +++ b/libs/components/editor-blocks/src/components/source-view/format-url/youtube.ts @@ -1,5 +1,6 @@ export const isYoutubeUrl = (url?: string): boolean => { - return url.includes('youtu.be') || url.includes('youtube.com'); + const allowedHosts = ['youtu.be', 'youtube.com']; + return allowedHosts.includes(url); }; const _regexp = /.*(?:youtu.be\/|v\/|u\/\w\/|embed\/|watch\?v=)([^#&?]*).*/; diff --git a/! b/! new file mode 100644 index 0000000000..e69de29bb2