fbdtemme / torrenttools

Commandline tool for inspecting, creating and editing BitTorrent metafiles.
MIT License
196 stars 14 forks source link

Announce URL Hijacking #4

Closed SpookyStuff closed 3 years ago

SpookyStuff commented 3 years ago

When you want to specify a custom announce URL but some part of the URL can be matched to an existing entry in trackers.json, then trackers.json will take precedence.

Using: torrenttools create -a 'http://please.passthepopcorn.me:2710/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/announce' -p -l 21 -v '1' -o ~/somewhere/ ~/somewhere/something.iso

Result: _Announces: tier 1 - http://please.passthepopcorn.me:2710/01qwqwdlc922_sample_pid_d93fqd6fji9/announce_

The reason for this is that the "passthepopcorn" portion of the URL matches with the name of an entry in trackers.json. This shouldn't happen.

Changing the URL to "please.passthepopcornxxx.me" ... Result: Announces: tier 1 - http://please.passthepopcornxxx.me:2710/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/announce

Of course, I can remove the entry from trackers.json (since I won't be using it), but it would nice if they can co-exist

I would think that, checking if the announce value starts with http, and if yes, then do not check in trackers.json

SpookyStuff commented 3 years ago

So, it's almost good in 0.3.2 now, but, because you're still trying to add Source to the metafile. When there's no existing match in trackers.json, no metafile is written.

So, no metafile created for: torrenttools create -a 'http://someplace.me:1111/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/announce' -p -l 21 -v '1' -o ~/somewhere/ ~/somewhere/something.iso

But this will have metafile because there's a matching Source: torrenttools create -a 'http://please.passthepopcorn.me:1111/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/announce' -p -l 21 -v '1' -o ~/somewhere/ ~/somewhere/something.iso

It's not really necessary for you to add the source. Since I'm adding a custom url, I would also likely adding my own custom source value either through torrenttools or through Bencode externally after metafile , for other reasons.

fbdtemme commented 3 years ago

Ugh, sorry about that. I really need to write more tests to catch things like this. Should be fixed now.