search

TTV-LOL / extensions

296 stars 24 forks source link

Seems my IP is being leaked to twitch? #21

Closed Jeremy-Laier closed 1 year ago

Jeremy-Laier commented 3 years ago

I have pasted an example below of the redirect URL

api.ttv.lol/playlist/streamer.m3u8%3Fallow_source%3Dtrue%26fast_bread%3Dtrue%26p%3A2255857%26play_session_id%3Ad453f480gg1r99h45a3095366ca5363a%26player_backend%3Dmediaplayer%26playlist_include_framerate%3Dtrue%26reassignments_supported%3Dtrue%26sig%3D86df4f12ab1d2ba8d99f82a81680be74e549c67a%26supported_codecs%3Dvp09%252Cavc1%26token%3D%257B%2522adblock%2522%253Afalse%252C%2522authorization%2522%253A%257B%2522forbidden%2522%253Afalse%252C%2522reason%2522%253A%2522%2522%257D%252C%2522blackout_enabled%2522%253Afalse%252C%2522channel%2522%253A%2522streamer%2522%252C%2522channel_id%2522%253A44338537%252C%2522chansub%2522%253A%257B%2522restricted_bitrates%2522%253A%255B%255D%252C%2522view_until%2522%253A1924905600%257D%252C%2522ci_gb%2522%253Afalse%252C%2522geoblock_reason%2522%253A%2522%2522%252C%2522device_id%2522%253A%2522Ob6oHtGYHjIKKJjjjRDwMe%2522%252C%2522expires%2522%253A1620467116%252C%2522extended_history_allowed%2522%253Afalse%252C%2522game%2522%253A%2522%2522%252C%2522hide_ads%2522%253Afalse%252C%2522https_required%2522%253Atrue%252C%2522mature%2522%253Afalse%252C%2522partner%2522%253Afalse%252C%2522platform%2522%253A%2522web%2522%252C%2522player_type%2522%253A%2522site%2522%252C%2522private%2522%253A%257B%2522allowed_to_view%2522%253Atrue%257D%252C%2522privileged%2522%253Afalse%252C%2522role%2522%253A%2522%2522%252C%2522server_ads%2522%253Atrue%252C%2522show_ads%2522%253Atrue%252C%2522subscriber%2522%253Afalse%252C%2522turbo%2522%253Afalse%252C%2522user_id%2522%253D7665776918%252C%2522user_ip%2522%253A%2522142.36.78.245%2522%252C%2522version%2522%253A2%257D%26cdm%3Dwv%26player_version%3D1.4.0

cougarten commented 2 years ago

Even worse, the code on github would strip your signature (whatever that does) and all details (IP is part of the "token"). The code in the firefox add-on does not do this!

image

It's the same for chrome.

To be fair though, it looks like the latest update intending to fix exactly this issue was merged but just not released to the add on stores. https://chrome.google.com/webstore/detail/ttv-lol/ofbbahodfeppoklmgjiokgfdgcndngjm