Fix proxy whitelist check

materialious/android/app/build.gradle

@@ -7,8 +7,8 @@ android {
         applicationId "us.materialio.app"
         minSdkVersion rootProject.ext.minSdkVersion
         targetSdkVersion rootProject.ext.targetSdkVersion
-        versionCode 211
-        versionName "1.15.3"
+        versionCode 212
+        versionName "1.15.4"
         testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
         aaptOptions {
              // Files and dirs to omit from the packaged assets dir, modified to accommodate modern web apps.

materialious/electron/materialious.metainfo.xml

@@ -76,7 +76,11 @@
     
     
     
-    <release version="1.15.3" date="2026-2-15">
+    
+    <release version="1.15.4" date="2026-2-16">
+      <url>https://github.com/Materialious/Materialious/releases/tag/1.15.4</url>
+    </release>
+<release version="1.15.3" date="2026-2-15">
       <url>https://github.com/Materialious/Materialious/releases/tag/1.15.3</url>
     </release>
 <release version="1.15.1" date="2026-2-15">

materialious/electron/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "Materialious",
-	"version": "1.15.3",
+	"version": "1.15.4",
 	"description": "Modern material design for YouTube and Invidious.",
 	"author": {
 		"name": "Ward Pearce",

materialious/package-lock.json

@@ -50,7 +50,6 @@
 				"peerjs": "^1.5.5",
 				"pg": "^8.18.0",
 				"pg-hstore": "^2.3.4",
-				"psl": "^1.15.0",
 				"sequelize": "^6.37.7",
 				"shaka-player": "^4.16.14",
 				"sponsorblock-api": "^0.2.4",
@@ -12564,18 +12563,6 @@
 			"integrity": "sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==",
 			"license": "MIT"
 		},
-		"node_modules/psl": {
-			"version": "1.15.0",
-			"resolved": "https://registry.npmjs.org/psl/-/psl-1.15.0.tgz",
-			"integrity": "sha512-JZd3gMVBAVQkSs6HdNZo9Sdo0LNcQeMNP3CozBJb3JYC/QUYZTnKxP+f8oWRX4rHP5EurWxqAHTSwUCjlNKa1w==",
-			"license": "MIT",
-			"dependencies": {
-				"punycode": "^2.3.1"
-			},
-			"funding": {
-				"url": "https://github.com/sponsors/lupomontero"
-			}
-		},
 		"node_modules/pump": {
 			"version": "3.0.3",
 			"resolved": "https://registry.npmjs.org/pump/-/pump-3.0.3.tgz",

materialious/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "materialious",
-	"version": "1.15.3",
+	"version": "1.15.4",
 	"private": true,
 	"scripts": {
 		"dev": "npm run patch:github && vite dev",
@@ -86,7 +86,6 @@
 		"peerjs": "^1.5.5",
 		"pg": "^8.18.0",
 		"pg-hstore": "^2.3.4",
-		"psl": "^1.15.0",
 		"sequelize": "^6.37.7",
 		"shaka-player": "^4.16.14",
 		"sponsorblock-api": "^0.2.4",

materialious/src/routes/.d.ts

@@ -1,2 +1 @@
 declare module 'virtual:pwa-info';
-declare module 'psl';

materialious/src/routes/api/proxy/[urlToProxy]/+server.ts

@@ -1,5 +1,4 @@
 import { isOwnBackend } from '$lib/shared';
-import psl from 'psl';
 import { env } from '$env/dynamic/public';
 
 import { error } from '@sveltejs/kit';
@@ -11,7 +10,7 @@ const allowedDomains: string[] = [
 	'returnyoutubedislike.com',
 	'sponsor.ajay.app',
 	'dearrow-thumb.ajay.app',
-	'materialio.us'
+	'ryd-proxy.materialio.us'
 ];
 
 const dynamicAllowDomains = [
@@ -24,16 +23,15 @@ const dynamicAllowDomains = [
 	env.PUBLIC_DEFAULT_COMPANION_INSTANCE
 ];
 
-dynamicAllowDomains.forEach((domain) => {
-	if (domain) {
-		allowedDomains.push(domain);
+for (const dynamicDomain of dynamicAllowDomains) {
+	if (dynamicDomain) {
+		allowedDomains.push(dynamicDomain.replace(/^https?:\/\//, ''));
 	}
-});
+}
 
 async function proxyRequest(
 	request: Request,
 	urlToProxy: string,
-	captchaKey: string,
 	userId: string | undefined = undefined
 ): Promise<Response> {
 	const backendRestrictions = isOwnBackend();
@@ -53,7 +51,7 @@ async function proxyRequest(
 		throw error(400, 'Invalid URL');
 	}
 
-	if (!allowedDomains.includes(psl.parse(urlToProxyObj.host).domain)) {
+	if (!allowedDomains.includes(urlToProxyObj.host)) {
 		// allowAnyProxy allows a instance owner to bypass the whitelist.
 		// BUT is extremely strict.
 		// AND I still don't recommend this.
@@ -63,7 +61,7 @@ async function proxyRequest(
 			backendRestrictions.registrationAllowed ||
 			!userId
 		) {
-			throw error(400, 'Invalid URL');
+			throw error(400, 'URL not whitelisted');
 		}
 	}
 
@@ -114,20 +112,20 @@ async function proxyRequest(
 }
 
 export async function GET({ request, params, locals }) {
-	return await proxyRequest(request, params.urlToProxy, locals.captchaKey, locals.userId);
+	return await proxyRequest(request, params.urlToProxy, locals.userId);
 }
 export async function PATCH({ request, params, locals }) {
-	return await proxyRequest(request, params.urlToProxy, locals.captchaKey, locals.userId);
+	return await proxyRequest(request, params.urlToProxy, locals.userId);
 }
 
 export async function DELETE({ request, params, locals }) {
-	return await proxyRequest(request, params.urlToProxy, locals.captchaKey, locals.userId);
+	return await proxyRequest(request, params.urlToProxy, locals.userId);
 }
 
 export async function PUT({ request, params, locals }) {
-	return await proxyRequest(request, params.urlToProxy, locals.captchaKey, locals.userId);
+	return await proxyRequest(request, params.urlToProxy, locals.userId);
 }
 
 export async function POST({ request, params, locals }) {
-	return await proxyRequest(request, params.urlToProxy, locals.captchaKey, locals.userId);
+	return await proxyRequest(request, params.urlToProxy, locals.userId);
 }

update_versions.py

@@ -3,7 +3,7 @@ import os
 import re
 from datetime import datetime
 
-LATEST_VERSION = "1.15.3"
+LATEST_VERSION = "1.15.4"
 RELEASE_DATE = datetime.now().strftime("%Y-%-m-%d")  # Format: YYYY-M-D
 
 WORKING_DIR = os.path.join(os.path.dirname(os.path.realpath(__file__)), "materialious")