fix: improve playback probe reliability for anti-hotlink sources - #220
Open
libertydragonn wants to merge 2 commits into
Open
fix: improve playback probe reliability for anti-hotlink sources#220libertydragonn wants to merge 2 commits into
libertydragonn wants to merge 2 commits into
Conversation
- New src/lib/proxy-security.ts: validateProxyTargetUrl blocks localhost,
private/link-local/CGNAT ranges, cloud metadata hosts and credentialed
URLs, resolves DNS and rejects targets answering with blocked addresses;
fetchWithValidatedRedirects re-validates every redirect hop.
- Opt-in allowlisting for self-hosted LAN media (NAS/Jellyfin) via
PROXY_ALLOW_PRIVATE_HOSTS=true + PROXY_PRIVATE_HOST_ALLOWLIST
(exact IPs, hostnames, IPv4 CIDRs).
- Apply validation to /api/proxy/{cms,key,logo,m3u8,segment,stream},
/api/download/{proxy,ffmpeg,ffmpeg/file}, /api/live/precheck and
/api/douban/health.
- Documented threat model: this significantly reduces SSRF exposure but
resolved IPs are not pinned to the socket, so DNS rebinding is
mitigated best-effort, not eliminated.
- Add proxy target validation regression tests.
No auth/cookie/middleware changes in this PR.
- Retry playlist and media probes with URL-derived Referer/Origin and alternate User-Agent headers so sources that reject bare requests are measured correctly instead of being misreported as dead. - Unwrap same-origin m3u8 proxy URLs for measurement-only direct checks when the proxied manifest returns 401/403. - Clamp the speed calculation to a 1ms minimum elapsed time so sub-millisecond reads never yield an undefined speed (this was the flaky jest failure in the previous review round); add a frozen-clock regression test for the same-millisecond read path. - Probe fetches validate targets and redirects via proxy-security. Depends on the proxy-security PR. No auth changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
背景
重做系列的播放源测速可靠性修复。依赖 SSRF 防护 PR（探测经过
fetchWithValidatedRedirects/validateProxyTargetUrl），在其合并前 diff 会包含那一支的 commit。改动
undefined（这正是上一轮 review 里jest --runInBand偶发失败的根因）；新增冻结时钟的回归测试覆盖同毫秒读取路径。验证
jest --runInBand通过（20 套件 / 108 测试；连续多次运行稳定，无偶发失败）pnpm typecheck通过docker build本分支镜像成功不改动登录 / 鉴权流程。