groove/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2025-12-20 18:59:37 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Update:HLS router request validation, smooth out transcode reset logic

Browse source
This commit is contained in:
advplyr 2023-10-14 12:50:48 -05:00
parent c98fac30b6
commit dcdd4bb20b
2 changed files with 60 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

65
server/routers/HlsRouter.js
View file

@ -27,28 +27,60 @@ class HlsRouter {
return Number(num_part)
}
async streamFileRequest(req, res) {
var streamId = req.params.stream
var fullFilePath = Path.join(this.playbackSessionManager.StreamsPath, streamId, req.params.file)
/**
* Ensure filepath is inside streamDir
* Used to prevent arbitrary file reads
* @see https://nodejs.org/api/path.html#pathrelativefrom-to
*
* @param {string} streamDir
* @param {string} filepath
* @returns {boolean}
*/
validateStreamFilePath(streamDir, filepath) {
const relative = Path.relative(streamDir, filepath)
return relative && !relative.startsWith('..') && !Path.isAbsolute(relative)
}
var exists = await fs.pathExists(fullFilePath)
if (!exists) {
/**
* GET /hls/:stream/:file
* File must have extname .ts or .m3u8
*
* @param {express.Request} req
* @param {express.Response} res
*/
async streamFileRequest(req, res) {
const streamId = req.params.stream
// Ensure stream is open
const stream = this.playbackSessionManager.getStream(streamId)
if (!stream) {
Logger.error(`[HlsRouter] Stream "${streamId}" does not exist`)
return res.sendStatus(404)
}
// Ensure stream filepath is valid
const streamDir = Path.join(this.playbackSessionManager.StreamsPath, streamId)
const fullFilePath = Path.join(streamDir, req.params.file)
if (!this.validateStreamFilePath(streamDir, fullFilePath)) {
Logger.error(`[HlsRouter] Invalid file parameter "${req.params.file}"`)
return res.sendStatus(400)
}
const fileExt = Path.extname(req.params.file)
if (fileExt !== '.ts' && fileExt !== '.m3u8') {
Logger.error(`[HlsRouter] Invalid file parameter "${req.params.file}" extname. Must be .ts or .m3u8`)
return res.sendStatus(400)
}
if (!(await fs.pathExists(fullFilePath))) {
Logger.warn('File path does not exist', fullFilePath)
var fileExt = Path.extname(req.params.file)
if (fileExt === '.ts' || fileExt === '.m4s') {
var segNum = this.parseSegmentFilename(req.params.file)
var stream = this.playbackSessionManager.getStream(streamId)
if (!stream) {
Logger.error(`[HlsRouter] Stream ${streamId} does not exist`)
return res.sendStatus(500)
}
if (fileExt === '.ts') {
const segNum = this.parseSegmentFilename(req.params.file)
if (stream.isResetting) {
Logger.info(`[HlsRouter] Stream ${streamId} is currently resetting`)
return res.sendStatus(404)
} else {
var startTimeForReset = await stream.checkSegmentNumberRequest(segNum)
const startTimeForReset = await stream.checkSegmentNumberRequest(segNum)
if (startTimeForReset) {
// HLS.js will restart the stream at the new time
Logger.info(`[HlsRouter] Resetting Stream - notify client @${startTimeForReset}s`)
@ -56,13 +88,12 @@ class HlsRouter {
startTime: startTimeForReset,
streamId: stream.id
})
return res.sendStatus(500)
}
}
}
return res.sendStatus(404)
}
// Logger.info('Sending file', fullFilePath)
res.sendFile(fullFilePath)
}
}