Skip to content

Conversation

@absidue
Copy link
Member

@absidue absidue commented May 2, 2025

Rewrite download code to avoid using Node APIs in the renderer

Pull Request Type

  • Security improvement

Related issues

Description

This pull request refactors the downloading code to no longer use Node.js APIs in the renderer process. Like the screenshot code the the code path that prompts the user where to save the file each time doesn't need any Node.js APIs anymore thanks to the Web File System API and writing to the default folder happens through an API call that only accepts the file name and file content (the default folder path is read in the main process).

Please note that improving the in-app downloader was a non-goal of this pull request, I just wanted to remove the usage of the Node.js APIs to get us one step closer to turning off nodeIntegration in the renderer processes. The downloader is still slow and for the default path approach it still buffers the entire downloaded file in memory, writing everything to the file in one go at the end. The prompting for a file path approach does now stream directly to the file though, thanks to the use of the Web File System API.

Testing

Try downloading subtitles and audio tracks on this short video with both the prompting for the file path and downloading to the default folder options: https://youtu.be/jNQXAC9IVRw

You are of course welcome to test with longer videos or downloading the video streams but as the downloader is very slow downloading that much data is going to take a long time and you just need to check that these changes didn't break anything.

Desktop

  • OS: Windows
  • OS Version: 10
  • FreeTube version: e2a53d0

@FreeTubeBot FreeTubeBot enabled auto-merge (squash) May 2, 2025 22:46
@github-actions github-actions bot added PR: dependencies Pull requests that update a dependency file PR: waiting for review For PRs that are complete, tested, and ready for review labels May 2, 2025
@FreeTubeBot FreeTubeBot merged commit da2bac8 into FreeTubeApp:development May 3, 2025
5 checks passed
@github-actions github-actions bot removed the PR: waiting for review For PRs that are complete, tested, and ready for review label May 3, 2025
@absidue absidue deleted the downloads-node-integration branch May 3, 2025 12:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

PR: dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants