search

lo-cafe / winston

A beautiful and native Reddit client for iOS
https://winston.cafe/
GNU General Public License v3.0
1.01k stars 70 forks source link

[BUG] Inadequate checking of domains when loading video media with custom loaders (streamable) #534

Open robigan opened 2 months ago

robigan commented 2 months ago

I was reviewing the code that handles loading of media, and noticed that in Winston, the check for if media can be loaded using Streamable simply checks the url string for the presence of streamable.com

https://github.com/lo-cafe/winston/blob/8447b13b706ce205bdba8f758eddd2848368b4d3/winston/components/Media/mediaExtractor.swift#L180-L182

Additionally, the extractor doesn't check for the presence of a valid video ID slug, or that the streamable.com link isn't another landing page/non-video page like their landing page https://streamable.com/pricing, with the extractor returning an empty string if a leading slash is present and the domain being returned if there are no path delimiters in the URL (in which case leads to Winston trying to load a streamable video with ID streamable.com).

https://github.com/lo-cafe/winston/blob/8447b13b706ce205bdba8f758eddd2848368b4d3/winston/components/Media/mediaExtractor.swift#L59

I see that right below, the URL is eventually parsed and then hosts are checked properly there, my suggestion would be to properly check the host component of the URL and only send the path component to the extractor.

linear[bot] commented 2 months ago

WIN-179 [BUG] Inadequate checking of domains when loading video media with custom loaders (streamable)

robigan commented 2 months ago

If you go to my post that tests for this, https://www.reddit.com/user/robigan/comments/1fj8g0z/winston_streamable_test/ or https://www.reddit.com/user/robigan/comments/1fj8sid/winston_streamable_test_failure/ you can observe this happening