search

iv-org / inv_sig_helper

GNU Affero General Public License v3.0
28 stars 8 forks source link

Player JS that results in 403 on videoplayback requests #11

Closed MMaster closed 2 months ago

MMaster commented 2 months ago

Player JS: https://www.youtube.com/s/player/1c78e434/player_ias.vflset/en_US/base.js

techmetx11 commented 2 months ago 
* as soon as different player js gets fetched everything works again

Sounds like YouTube rapidly changing the JavaScript file to invalidate signatures?

MMaster commented 2 months ago

Sounds like YouTube rapidly changing the JavaScript file to invalidate signatures?

Right after restart of invidious & inv_sig_helper - if this player gets fetched all videoplayback requests return 403. If I force update of player and different one gets fetched all videoplayback requests immediately work. I even tried to force update with each watch request and every time this one gets fetched I get 403s on all videoplayback requests immediately.

MMaster commented 2 months ago

Just a wild guess: I suspect it can be because of this /[/"}][,]/ being part of the nsig decrypt code values which I haven't seen there before. Maybe it's not escaped correctly before being processed by the interpreter?

EDIT: looking at the code that's probably not right. It's just me not being that familiar with the js interpreter part :)

techmetx11 commented 2 months ago

Just a wild guess: I suspect it can be because of this /[/"}][,]/ being part of the nsig decrypt code values which I haven't seen there before. Maybe it's not escaped correctly before being processed by the interpreter?

EDIT: looking at the code that's probably not right. It's just me not being that familiar with the js interpreter part :)

Can you point to it in the source code?

MMaster commented 2 months ago

Can you point to it in the source code?

The nsig decrypt function in that base.js is called Nma it starts on line 1584. That value is one of the values in c array there. I just tried to print out the code that gets passed to Eval and it matches.

EDIT: I just got a hint from SamantazFox that this may be related to invidious video cache. I'm going to remove the caching and check again. This may not be an issue with inv_sig_helper.

MMaster commented 2 months ago

Yes. It looks like it was issue with invidious video caching. Sorry for wasting your time and thank you for being so fast in replying :)