fix: enforce domain boundary in YouTube URL hostname check

getYoutubVideoIDFromURL used strings.HasSuffix(hostname, "youtube.com")
with no leading dot, so any hostname that merely ends in that string
(e.g. notyoutube.com, totally-legit-youtube.com) was misidentified as a
YouTube URL and rewritten into a YouTube/Invidious embed iframe using an
attacker-controlled ?v= value as the video ID. Sibling code in
referer_override.go handles the same class of check correctly with a
leading dot (e.g. strings.HasSuffix(hostname, ".cdninstagram.com")) --
this function was the outlier.

Fixed by checking for an exact match on "youtube.com" or a suffix match
on ".youtube.com", mirroring referer_override.go's existing pattern.

internal/reader/rewrite/content_rewrite_functions.go

@@ -265,7 +265,8 @@ func getYoutubVideoIDFromURL(entryURL string) string {
 		return ""
 	}
 
-	if !strings.HasSuffix(u.Hostname(), "youtube.com") {
+	hostname := u.Hostname()
+	if hostname != "youtube.com" && !strings.HasSuffix(hostname, ".youtube.com") {
 		return ""
 	}
 

internal/reader/rewrite/content_rewrite_test.go

@@ -126,6 +126,26 @@ func TestRewriteIncorrectYoutubeLink(t *testing.T) {
 	}
 }
 
+func TestRewriteYoutubeLinkRejectsLookalikeDomain(t *testing.T) {
+	config.Opts = config.NewConfigOptions()
+
+	controlEntry := &model.Entry{
+		URL:     "https://notyoutube.com/watch?v=1234",
+		Title:   `A title`,
+		Content: `Video Description`,
+	}
+	testEntry := &model.Entry{
+		URL:     "https://notyoutube.com/watch?v=1234",
+		Title:   `A title`,
+		Content: `Video Description`,
+	}
+	ApplyContentRewriteRules(testEntry, `add_youtube_video`)
+
+	if !reflect.DeepEqual(testEntry, controlEntry) {
+		t.Errorf(`A domain that merely ends in "youtube.com" must not be treated as YouTube: got "%+v" instead of "%+v"`, testEntry, controlEntry)
+	}
+}
+
 func TestRewriteYoutubeLinkAndCustomEmbedURL(t *testing.T) {
 	os.Clearenv()
 	os.Setenv("YOUTUBE_EMBED_URL_OVERRIDE", "https://invidious.custom/embed/")