invidious: only allow "known" URLs

bin/invidious.sh

@@ -28,6 +28,16 @@ api()
 	printf "https://%s%s\n" "$INVIDIOUS" "$*"
 }
 
+known_site()
+{
+	printf "%s\n" "$1" | grep -Eq \
+	    -e "^https://(www\.)?youtube\.com/" \
+	    -e "^https://youtu\.be/" \
+	    -e "^https://(www\.)?invidio\.us/" \
+	    -e "^https://invidious\.snopyta\.org/" \
+	    -e "^https://yewtu\.be/"
+}
+
 : ${INVIDIOUS:=invidious.snopyta.org}
 
 torsocks=torsocks
@@ -42,8 +52,8 @@ done
 shift $((OPTIND - 1))
 [ $# -eq 1 ] || usage
 
-# XXX check URL for known sites
 url=$1
+known_site "$url" || err "Unknown site: $url"
 
 oldIFS=$IFS
 IFS="&"