Skip to content
This repository was archived by the owner on Apr 22, 2023. It is now read-only.

Commit 3a4f09d

Browse files
RudloffRudloff
committed
Prevent SSRF requests
By validating the provided URL before passing it to youtube-dl
1 parent 2afbfb4 commit 3a4f09d

7 files changed

+845
-192
lines changed

‎classes/Controller/BaseController.php

+20-1
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,9 @@
1111
use Alltube\Library\Video;
1212
use Alltube\LocaleManager;
1313
use Aura\Session\Segment;
14+
use Graby\HttpClient\Plugin\ServerSideRequestForgeryProtection\Exception\InvalidURLException;
15+
use Graby\HttpClient\Plugin\ServerSideRequestForgeryProtection\Options;
16+
use Graby\HttpClient\Plugin\ServerSideRequestForgeryProtection\Url;
1417
use Psr\Container\ContainerInterface;
1518
use Psr\Log\LoggerInterface;
1619
use Slim\Http\Request;
@@ -127,10 +130,11 @@ protected function getFormat(Request $request): string
127130
* @param Request $request PSR-7 request
128131
*
129132
* @return string|null Password
133+
* @throws InvalidURLException
130134
*/
131135
protected function getPassword(Request $request): ?string
132136
{
133-
$url = $request->getQueryParam('url');
137+
$url = $this->getVideoPageUrl($request);
134138

135139
$password = $request->getParam('password');
136140
if (isset($password)) {
@@ -157,4 +161,19 @@ protected function displayError(Request $request, Response $response, string $me
157161

158162
return $controller->displayError($request, $response, $message);
159163
}
164+
165+
/**
166+
* @param Request $request
167+
* @return string
168+
* @throws InvalidURLException
169+
*/
170+
protected function getVideoPageUrl(Request $request): string
171+
{
172+
$url = $request->getQueryParam('url') ?: $request->getQueryParam('v');
173+
174+
// Prevent SSRF attacks.
175+
$parts = Url::validateUrl($url, new Options());
176+
177+
return $parts['url'];
178+
}
160179
}

‎classes/Controller/DownloadController.php

+36-38
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
use Alltube\Stream\ConvertedPlaylistArchiveStream;
2020
use Alltube\Stream\PlaylistArchiveStream;
2121
use Alltube\Stream\YoutubeStream;
22+
use Graby\HttpClient\Plugin\ServerSideRequestForgeryProtection\Exception\InvalidURLException;
2223
use Slim\Http\Request;
2324
use Slim\Http\Response;
2425
use Slim\Http\StatusCode;
@@ -37,56 +38,53 @@ class DownloadController extends BaseController
3738
*
3839
* @return Response HTTP response
3940
* @throws AlltubeLibraryException
41+
* @throws InvalidURLException
4042
*/
4143
public function download(Request $request, Response $response): Response
4244
{
43-
$url = $request->getQueryParam('url');
45+
$url = $this->getVideoPageUrl($request);
4446

45-
if (isset($url)) {
46-
$this->video = $this->downloader->getVideo($url, $this->getFormat($request), $this->getPassword($request));
47+
$this->video = $this->downloader->getVideo($url, $this->getFormat($request), $this->getPassword($request));
4748

48-
try {
49-
if ($this->config->convert && $request->getQueryParam('audio')) {
50-
// Audio convert.
51-
return $this->getAudioResponse($request, $response);
52-
} elseif ($this->config->convertAdvanced && !is_null($request->getQueryParam('customConvert'))) {
53-
// Advance convert.
54-
return $this->getConvertedResponse($request, $response);
55-
}
49+
try {
50+
if ($this->config->convert && $request->getQueryParam('audio')) {
51+
// Audio convert.
52+
return $this->getAudioResponse($request, $response);
53+
} elseif ($this->config->convertAdvanced && !is_null($request->getQueryParam('customConvert'))) {
54+
// Advance convert.
55+
return $this->getConvertedResponse($request, $response);
56+
}
5657

57-
// Regular download.
58-
return $this->getDownloadResponse($request, $response);
59-
} catch (PasswordException $e) {
60-
$frontController = new FrontController($this->container);
58+
// Regular download.
59+
return $this->getDownloadResponse($request, $response);
60+
} catch (PasswordException $e) {
61+
$frontController = new FrontController($this->container);
6162

62-
return $frontController->password($request, $response);
63-
} catch (WrongPasswordException $e) {
64-
return $this->displayError($request, $response, $this->localeManager->t('Wrong password'));
65-
} catch (PlaylistConversionException $e) {
63+
return $frontController->password($request, $response);
64+
} catch (WrongPasswordException $e) {
65+
return $this->displayError($request, $response, $this->localeManager->t('Wrong password'));
66+
} catch (PlaylistConversionException $e) {
67+
return $this->displayError(
68+
$request,
69+
$response,
70+
$this->localeManager->t('Conversion of playlists is not supported.')
71+
);
72+
} catch (InvalidProtocolConversionException $e) {
73+
if (in_array($this->video->protocol, ['m3u8', 'm3u8_native'])) {
6674
return $this->displayError(
6775
$request,
6876
$response,
69-
$this->localeManager->t('Conversion of playlists is not supported.')
77+
$this->localeManager->t('Conversion of M3U8 files is not supported.')
7078
);
71-
} catch (InvalidProtocolConversionException $e) {
72-
if (in_array($this->video->protocol, ['m3u8', 'm3u8_native'])) {
73-
return $this->displayError(
74-
$request,
75-
$response,
76-
$this->localeManager->t('Conversion of M3U8 files is not supported.')
77-
);
78-
} elseif ($this->video->protocol == 'http_dash_segments') {
79-
return $this->displayError(
80-
$request,
81-
$response,
82-
$this->localeManager->t('Conversion of DASH segments is not supported.')
83-
);
84-
} else {
85-
throw $e;
86-
}
79+
} elseif ($this->video->protocol == 'http_dash_segments') {
80+
return $this->displayError(
81+
$request,
82+
$response,
83+
$this->localeManager->t('Conversion of DASH segments is not supported.')
84+
);
85+
} else {
86+
throw $e;
8787
}
88-
} else {
89-
return $response->withRedirect($this->router->pathFor('index'));
9088
}
9189
}
9290

‎classes/Controller/FrontController.php

+10-12
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
use Alltube\Locale;
1313
use Alltube\Middleware\CspMiddleware;
1414
use Exception;
15+
use Graby\HttpClient\Plugin\ServerSideRequestForgeryProtection\Exception\InvalidURLException;
1516
use Slim\Http\StatusCode;
1617
use Symfony\Component\ErrorHandler\ErrorRenderer\HtmlErrorRenderer;
1718
use Throwable;
@@ -198,24 +199,21 @@ private function getInfoResponse(Request $request, Response $response)
198199
*
199200
* @return Response HTTP response
200201
* @throws AlltubeLibraryException
202+
* @throws InvalidURLException
201203
*/
202204
public function info(Request $request, Response $response): Response
203205
{
204-
$url = $request->getQueryParam('url') ?: $request->getQueryParam('v');
206+
$url = $this->getVideoPageUrl($request);
205207

206-
if (isset($url) && !empty($url)) {
207-
$this->video = $this->downloader->getVideo($url, $this->getFormat($request), $this->getPassword($request));
208+
$this->video = $this->downloader->getVideo($url, $this->getFormat($request), $this->getPassword($request));
208209

209-
if ($this->config->convert && $request->getQueryParam('audio')) {
210-
// We skip the info page and get directly to the download.
211-
return $response->withRedirect(
212-
$this->router->pathFor('download', [], $request->getQueryParams())
213-
);
214-
} else {
215-
return $this->getInfoResponse($request, $response);
216-
}
210+
if ($this->config->convert && $request->getQueryParam('audio')) {
211+
// We skip the info page and get directly to the download.
212+
return $response->withRedirect(
213+
$this->router->pathFor('download', [], $request->getQueryParams())
214+
);
217215
} else {
218-
return $response->withRedirect($this->router->pathFor('index'));
216+
return $this->getInfoResponse($request, $response);
219217
}
220218
}
221219

‎classes/Controller/JsonController.php

+6-5
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@
77
namespace Alltube\Controller;
88

99
use Alltube\Library\Exception\AlltubeLibraryException;
10+
use Exception;
11+
use Graby\HttpClient\Plugin\ServerSideRequestForgeryProtection\Exception\InvalidURLException;
1012
use Slim\Http\Request;
1113
use Slim\Http\Response;
1214
use Slim\Http\StatusCode;
@@ -23,22 +25,21 @@ class JsonController extends BaseController
2325
* @param Response $response PSR-7 response
2426
*
2527
* @return Response HTTP response
26-
* @throws AlltubeLibraryException
2728
*/
2829
public function json(Request $request, Response $response): Response
2930
{
30-
$url = $request->getQueryParam('url');
31+
try {
32+
$url = $this->getVideoPageUrl($request);
3133

32-
if (isset($url)) {
3334
$this->video = $this->downloader->getVideo(
3435
$url,
3536
$this->getFormat($request),
3637
$this->getPassword($request)
3738
);
3839

3940
return $response->withJson($this->video->getJson());
40-
} else {
41-
return $response->withJson(['error' => 'You need to provide the url parameter'])
41+
} catch (InvalidURLException $e) {
42+
return $response->withJson(['error' => $e->getMessage()])
4243
->withStatus(StatusCode::HTTP_BAD_REQUEST);
4344
}
4445
}

‎composer.json

+1
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
"aura/session": "^2.1",
2626
"barracudanetworks/archivestream-php": "^1.0",
2727
"consolidation/log": "^2.0",
28+
"j0k3r/httplug-ssrf-plugin": "^2.0",
2829
"jawira/case-converter": "^3.4",
2930
"jean85/pretty-package-versions": "^1.3",
3031
"mathmarques/smarty-view": "^1.1",

0 commit comments

Comments
 (0)