Problem

The current implementation ofisYouTubeNoCookie(url) uses a substring check:

returnurl.includes('youtube-nocookie.com');

This is unsafe becauseyoutube-nocookie.com can appear anywhere in the string, including in malicious or misleading URLs such as:https://attacker.com/youtube-nocookie.com.fake.site
This would incorrectly pass the check, even though the host is notyoutube-nocookie.com.

Solution

This PR improves the validation by parsing the URL with the URL constructor and comparing the host value directly:

varisYouTubeNoCookie=function(url){try{varparsedUrl=newURL(url);returnparsedUrl.host==='youtube-nocookie.com';}catch(e){returnfalse;// Fails safely if the URL is invalid}};

This ensures the function only returns true for valid URLs that have an exact hostname match.

Benefits

✅ Prevents false positives on malicious or incorrectly formatted URLs
✅ Improves security by relying on structured URL parsing
✅ Passes CodeQL analysis and aligns with secure coding practices
✅ Makes the plugin more robust and reliable