Implemented whitelist for proxy

materialious/package-lock.json

@@ -66,6 +66,7 @@
 				"patch-package": "^8.0.1",
 				"prettier": "^3.6.2",
 				"prettier-plugin-svelte": "^3.4.0",
+				"psl": "^1.15.0",
 				"svelte": "^5.47.0",
 				"svelte-awesome-color-picker": "^4.1.1",
 				"svelte-check": "^4.3.3",
@@ -11409,6 +11410,19 @@
 			"integrity": "sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==",
 			"license": "MIT"
 		},
+		"node_modules/psl": {
+			"version": "1.15.0",
+			"resolved": "https://registry.npmjs.org/psl/-/psl-1.15.0.tgz",
+			"integrity": "sha512-JZd3gMVBAVQkSs6HdNZo9Sdo0LNcQeMNP3CozBJb3JYC/QUYZTnKxP+f8oWRX4rHP5EurWxqAHTSwUCjlNKa1w==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"punycode": "^2.3.1"
+			},
+			"funding": {
+				"url": "https://github.com/sponsors/lupomontero"
+			}
+		},
 		"node_modules/pump": {
 			"version": "3.0.3",
 			"resolved": "https://registry.npmjs.org/pump/-/pump-3.0.3.tgz",

materialious/package.json

@@ -35,6 +35,7 @@
 		"patch-package": "^8.0.1",
 		"prettier": "^3.6.2",
 		"prettier-plugin-svelte": "^3.4.0",
+		"psl": "^1.15.0",
 		"svelte": "^5.47.0",
 		"svelte-awesome-color-picker": "^4.1.1",
 		"svelte-check": "^4.3.3",

materialious/src/lib/misc.ts

@@ -234,16 +234,14 @@ export type IsOwnBackend = {
 	builtWithBackend: boolean;
 	internalAuth: boolean;
 	requireAuth: boolean;
-	proxyWithoutAuth: boolean;
 };
 export function isOwnBackend(): IsOwnBackend | false {
 	if (import.meta.env.VITE_BUILD_WITH_BACKEND !== 'true') return false;
 
 	return {
 		builtWithBackend: true,
-		internalAuth: import.meta.env.VITE_INTERNAL_AUTH === 'true',
-		requireAuth: import.meta.env.VITE_REQUIRE_AUTH === 'true',
-		proxyWithoutAuth: import.meta.env.VITE_PROXY_WITHOUT_AUTH === 'true'
+		internalAuth: import.meta.env.VITE_INTERNAL_AUTH === 'false',
+		requireAuth: import.meta.env.VITE_REQUIRE_AUTH === 'false'
 	};
 }
 

materialious/src/routes/api/proxy/[urlToProxy]/+server.ts

@@ -1,3 +1,30 @@
+import psl from 'psl';
+
+const allowedDomains: string[] = [
+	'youtube.com',
+	'ytimg.com',
+	'googlevideo.com',
+	'returnyoutubedislike.com',
+	'sponsor.ajay.app',
+	'dearrow-thumb.ajay.app',
+	'materialio.us'
+];
+
+const dynamicAllowDomains = [
+	process.env.VITE_DEFAULT_DEARROW_THUMBNAIL_INSTANCE,
+	process.env.VITE_DEFAULT_DEARROW_INSTANCE,
+	process.env.VITE_DEFAULT_INVIDIOUS_INSTANCE,
+	process.env.VITE_DEFAULT_RETURNYTDISLIKES_INSTANCE,
+	process.env.VITE_DEFAULT_API_EXTENDED_INSTANCE,
+	process.env.VITE_DEFAULT_SYNCIOUS_INSTANCE
+];
+
+dynamicAllowDomains.forEach((domain) => {
+	if (domain) {
+		allowedDomains.push(domain);
+	}
+});
+
 async function proxyRequest(request: Request, urlToProxy: string): Promise<Response> {
 	let urlToProxyObj: URL;
 	try {
@@ -6,6 +33,10 @@ async function proxyRequest(request: Request, urlToProxy: string): Promise<Respo
 		return new Response('Invalid URL', { status: 400 });
 	}
 
+	if (!allowedDomains.includes(psl.parse(urlToProxyObj.host).domain)) {
+		return new Response('Invalid URL', { status: 400 });
+	}
+
 	if (urlToProxyObj.pathname.includes('v1/player')) {
 		urlToProxyObj.searchParams.set(
 			'$fields',