Files
AeroFetch/src/main/probe.ts
T
debont80 3536626a8a security: harden command exec, IPC, deep-link, cookies, and persistence
Seven-tier security audit of the main process, each finding fixed with a
regression test. Typecheck (node + web) clean; unit tests 106 -> 140.

- Tier 1 (command exec/argv): allowlist the yt-dlp --update-to channel
  (blocks arbitrary-binary-install RCE); gate per-download extraArgs behind
  the customCommandEnabled consent flag in main (blocks --exec RCE); resolve
  taskkill/schtasks by absolute System32 path; validate per-download
  outputDir; normalize the URL in assertHttpUrl and use it at every spawn.
- Tier 2 (input validation): fix isSafeFilenameTemplate drive-relative
  ('C:foo') and Windows dotted-'..' traversal bypasses; percent-encode the
  untrusted id in entryUrl; catch reserved device names with extensions in
  sanitizeDirSegment.
- Tier 3 (fs/backup): drop malformed template rows in importBackup;
  normalize deep-link URLs via assertHttpUrl.
- Tier 4 (cookies): confine the sign-in window's navigations/popups to web
  URLs (recursively) and deny all web permissions on its session.
- Tier 5 (deep-link/argv): bound the .url file read to 64 KB; match the
  aerofetch:// scheme case-insensitively.
- Tier 6 (Electron window): deny camera/mic/geolocation/USB/HID/serial/
  Bluetooth permissions on the app window.
- Tier 7 (network/persistence): restrict the watched-source RSS fetch to
  youtube.com feed URLs (SSRF guard); complete isValidSource validation.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 08:04:19 -04:00

162 lines
5.0 KiB
TypeScript

import { execFile } from 'child_process'
import { existsSync } from 'fs'
import { getYtdlpPath } from './binaries'
import { fmtBytes } from './download'
import { cleanError } from './log'
import { assertHttpUrl } from './url'
import { entryUrl, fmtDuration, type RawEntry } from './indexerCore'
import {
BEST_FORMAT_ID,
type ProbeResult,
type MediaInfo,
type FormatOption,
type PlaylistInfo,
type PlaylistEntry
} from '@shared/ipc'
// The slice of `yt-dlp -J` output we actually read.
interface RawFormat {
format_id: string
ext?: string
vcodec?: string
acodec?: string
height?: number
fps?: number
tbr?: number
filesize?: number
filesize_approx?: number
}
interface RawInfo {
_type?: string
title?: string
uploader?: string
channel?: string
duration_string?: string
thumbnail?: string
formats?: RawFormat[]
entries?: RawEntry[]
}
/** Quality proxy for picking the best format at a given height. */
function score(f: RawFormat): number {
return (f.tbr ?? 0) + (f.ext === 'mp4' ? 0.5 : 0)
}
function toOption(f: RawFormat): FormatOption {
const size = f.filesize ?? f.filesize_approx
const fpsTag = f.fps && f.fps > 30 ? String(Math.round(f.fps)) : ''
const sizeLabel = size ? fmtBytes(size) : undefined
const parts = [`${f.height}p${fpsTag}`, f.ext, sizeLabel].filter(Boolean) as string[]
return {
id: f.format_id,
label: parts.join(' · '),
height: f.height,
ext: f.ext,
filesizeLabel: sizeLabel,
hasAudio: !!f.acodec && f.acodec !== 'none'
}
}
/** One option per distinct height (best at that height), best-first, plus auto. */
function buildVideoFormats(raw: RawFormat[]): FormatOption[] {
const bestByHeight = new Map<number, RawFormat>()
for (const f of raw) {
if (!f.vcodec || f.vcodec === 'none' || !f.height) continue
const cur = bestByHeight.get(f.height)
if (!cur || score(f) > score(cur)) bestByHeight.set(f.height, f)
}
const options = [...bestByHeight.values()]
.sort((a, b) => (b.height ?? 0) - (a.height ?? 0))
.map(toOption)
options.unshift({ id: BEST_FORMAT_ID, label: 'Best available', ext: 'mp4', hasAudio: true })
return options
}
function buildInfo(data: RawInfo): MediaInfo {
return {
title: data.title || 'Untitled',
channel: data.channel || data.uploader || undefined,
durationLabel: data.duration_string || undefined,
thumbnail: data.thumbnail || undefined,
formats: buildVideoFormats(data.formats ?? [])
}
}
function buildPlaylist(data: RawInfo): PlaylistInfo {
const entries: PlaylistEntry[] = []
;(data.entries ?? []).forEach((e, i) => {
const url = entryUrl(e)
if (!url) return // skip entries we can't turn into a downloadable URL
entries.push({
index: i + 1,
id: e.id || String(i + 1),
title: e.title || `Item ${i + 1}`,
url,
durationLabel: fmtDuration(e.duration),
uploader: e.uploader || e.channel || undefined
})
})
return {
title: data.title || 'Playlist',
uploader: data.uploader || data.channel || undefined,
count: entries.length,
entries
}
}
/**
* Probe a URL with `yt-dlp -J --flat-playlist`. Resolves to a single video (with
* its format list) or, when the URL is a playlist, the flat list of its entries.
* `--flat-playlist` is a no-op for a lone video, so one call covers both cases.
*/
export function probeMedia(url: string): Promise<ProbeResult> {
const ytdlp = getYtdlpPath()
if (!existsSync(ytdlp)) {
return Promise.resolve({
ok: false,
error: `yt-dlp.exe not found at ${ytdlp}\nDrop it into resources/bin/ (see the README there).`
})
}
let target: string
try {
target = assertHttpUrl(url) // normalised form (audit F5)
} catch (e) {
return Promise.resolve({ ok: false, error: (e as Error).message })
}
return new Promise((resolve) => {
execFile(
ytdlp,
// `--` terminates option parsing so the URL can never be read as a flag.
['-J', '--flat-playlist', '--no-warnings', '--', target],
{ windowsHide: true, maxBuffer: 64 * 1024 * 1024, timeout: 60_000 },
(err, stdout, stderr) => {
if (err) {
// execFile sets `killed` when it terminated the process on timeout.
const msg = (err as { killed?: boolean }).killed
? 'Timed out fetching video info. Check the link or your connection.'
: cleanError(stderr) || err.message
resolve({ ok: false, error: msg })
return
}
try {
const data = JSON.parse(stdout) as RawInfo
if (data._type === 'playlist' || Array.isArray(data.entries)) {
const playlist = buildPlaylist(data)
if (playlist.count === 0) {
resolve({ ok: false, error: 'This playlist has no downloadable entries.' })
return
}
resolve({ ok: true, kind: 'playlist', playlist })
} else {
resolve({ ok: true, kind: 'video', info: buildInfo(data) })
}
} catch {
resolve({ ok: false, error: 'Could not parse video info from yt-dlp.' })
}
}
)
})
}