debont80
3536626a8a
Seven-tier security audit of the main process, each finding fixed with a
regression test. Typecheck (node + web) clean; unit tests 106 -> 140.
- Tier 1 (command exec/argv): allowlist the yt-dlp --update-to channel
(blocks arbitrary-binary-install RCE); gate per-download extraArgs behind
the customCommandEnabled consent flag in main (blocks --exec RCE); resolve
taskkill/schtasks by absolute System32 path; validate per-download
outputDir; normalize the URL in assertHttpUrl and use it at every spawn.
- Tier 2 (input validation): fix isSafeFilenameTemplate drive-relative
('C:foo') and Windows dotted-'..' traversal bypasses; percent-encode the
untrusted id in entryUrl; catch reserved device names with extensions in
sanitizeDirSegment.
- Tier 3 (fs/backup): drop malformed template rows in importBackup;
normalize deep-link URLs via assertHttpUrl.
- Tier 4 (cookies): confine the sign-in window's navigations/popups to web
URLs (recursively) and deny all web permissions on its session.
- Tier 5 (deep-link/argv): bound the .url file read to 64 KB; match the
aerofetch:// scheme case-insensitively.
- Tier 6 (Electron window): deny camera/mic/geolocation/USB/HID/serial/
Bluetooth permissions on the app window.
- Tier 7 (network/persistence): restrict the watched-source RSS fetch to
youtube.com feed URLs (SSRF guard); complete isValidSource validation.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
55 lines
2.4 KiB
TypeScript
55 lines
2.4 KiB
TypeScript
/**
|
|
* Watched-source sync (Pinchflat-style; ROADMAP-PINCHFLAT.md Phase J). Re-indexes
|
|
* every watched Source and reports the videos that are new since its last index.
|
|
* A YouTube RSS feed is used as a cheap pre-check so a source with no new uploads
|
|
* is skipped before the (more expensive) full `yt-dlp` re-index.
|
|
*/
|
|
|
|
import { listSources, listMediaItems } from './sources'
|
|
import { indexSource } from './indexer'
|
|
import { parseRssVideoIds, isYouTubeFeedUrl } from './indexerCore'
|
|
import type { IndexProgress, MediaItem, SyncResult } from '@shared/ipc'
|
|
|
|
/** Fetch a YouTube RSS feed and return its recent video ids. Throws on failure. */
|
|
async function fetchFeedIds(feedUrl: string): Promise<string[]> {
|
|
// Only ever fetch a genuine YouTube feed — refuse an arbitrary host that a
|
|
// corrupted sources.json might carry (SSRF guard, audit T7). A throw here is
|
|
// caught by the caller, which then falls back to a full yt-dlp re-index.
|
|
if (!isYouTubeFeedUrl(feedUrl)) throw new Error('Refusing to fetch a non-YouTube feed URL.')
|
|
const res = await fetch(feedUrl, { signal: AbortSignal.timeout(15_000) })
|
|
if (!res.ok) throw new Error(`feed responded ${res.status}`)
|
|
return parseRssVideoIds(await res.text())
|
|
}
|
|
|
|
/**
|
|
* Re-index every watched source and collect the videos new since the last index.
|
|
* RSS pre-check: if the feed shows only ids the source already knows, the full
|
|
* re-index is skipped. `onProgress` is forwarded from the underlying indexSource.
|
|
*/
|
|
export async function syncWatchedSources(
|
|
onProgress: (p: IndexProgress) => void
|
|
): Promise<SyncResult> {
|
|
try {
|
|
const watched = listSources().filter((s) => s.watched)
|
|
const newItems: MediaItem[] = []
|
|
for (const src of watched) {
|
|
// Cheap freshness check — skip the full re-index when nothing is new.
|
|
if (src.feedUrl) {
|
|
const known = new Set(listMediaItems(src.id).map((m) => m.videoId))
|
|
const recent = await fetchFeedIds(src.feedUrl).catch(() => null)
|
|
if (recent && recent.length > 0 && recent.every((id) => known.has(id))) continue
|
|
}
|
|
const before = new Set(listMediaItems(src.id).map((m) => m.videoId))
|
|
const res = await indexSource(src.url, onProgress)
|
|
if (res.ok) {
|
|
for (const it of listMediaItems(src.id)) {
|
|
if (!before.has(it.videoId)) newItems.push(it)
|
|
}
|
|
}
|
|
}
|
|
return { ok: true, newItems }
|
|
} catch (e) {
|
|
return { ok: false, newItems: [], error: e instanceof Error ? e.message : String(e) }
|
|
}
|
|
}
|