Potential fix for code scanning alert no. 1: Incomplete URL substring sanitization

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Author: neatudarius

src/components/youtube-transformer.js

@@ -1,12 +1,28 @@
 const YouTubeTransformer = {
   name: "YouTube",
   shouldTransform(url) {
-    return url.includes("youtube.com") || url.includes("youtu.be");
+    try {
+      const parsed = new URL(url);
+      const hostname = parsed.hostname.toLowerCase();
+      const allowedHosts = [
+        "youtube.com",
+        "www.youtube.com",
+        "m.youtube.com",
+        "youtu.be",
+        "www.youtu.be"
+      ];
+      return allowedHosts.includes(hostname);
+    } catch (e) {
+      // If the URL cannot be parsed, it cannot be a valid YouTube URL.
+      return false;
+    }
   },
   getHTML(url) {
-    const videoId = url.includes("youtu.be")
-      ? url.split("/").pop()
-      : new URL(url).searchParams.get("v");
+    const urlObj = new URL(url);
+    const isShort = urlObj.hostname.toLowerCase() === "youtu.be" || urlObj.hostname.toLowerCase() === "www.youtu.be";
+    const videoId = isShort
+      ? urlObj.pathname.split("/").filter(Boolean).pop()
+      : urlObj.searchParams.get("v");
 
     return `
       <iframe