facebook: do not request the source url & clean up

fixed a vulnerability, removed useless variables, and cleaned up

thankfully we haven't built the image yesterday
This commit is contained in:
wukko 2024-07-25 11:57:02 +06:00
parent faeb96848b
commit 83af16bb12
No known key found for this signature in database
GPG key ID: 3E30B3F26C7B4AA2
4 changed files with 24 additions and 30 deletions

View file

@ -203,8 +203,7 @@ export default async function(host, patternMatch, lang, obj) {
break;
case "facebook":
r = await facebook({
...patternMatch,
sourceUrl: url.href
...patternMatch
});
break;
default:

View file

@ -4,59 +4,53 @@ const headers = {
'User-Agent': genericUserAgent,
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8',
'Accept-Language': 'en-US,en;q=0.5',
'Accept-Encoding': 'gzip, deflate, br',
'Sec-Fetch-Mode': 'navigate',
'Sec-Fetch-Site': 'none',
}
function resolveUrl(url) {
const resolveUrl = (url) => {
return fetch(url, { headers })
.then(r => {
if (r.headers.get('location')) {
return decodeURIComponent(r.headers.get('location'))
return decodeURIComponent(r.headers.get('location'));
}
if (r.headers.get('link')) {
const linkMatch = r.headers.get('link').match(/<(.*?)\/>/)
return decodeURIComponent(linkMatch[1])
const linkMatch = r.headers.get('link').match(/<(.*?)\/>/);
return decodeURIComponent(linkMatch[1]);
}
return false
return false;
})
.catch(() => false)
.catch(() => false);
}
export default async function({ sourceUrl, shortLink, username, id }) {
const isShortLink = !!shortLink?.length
const isSharedLink = !!sourceUrl.match(/\/share\/\w\//)?.length
export default async function({ id, shareType, shortLink }) {
let url = `https://web.facebook.com/i/videos/${id}`;
let url = isShortLink
? `https://fb.watch/${shortLink}`
: `https://web.facebook.com/${username}/videos/${id}`
if (isShortLink) url = await resolveUrl(url)
if (isSharedLink) url = sourceUrl
if (shareType) url = `https://web.facebook.com/share/${shareType}/${id}`;
if (shortLink) url = await resolveUrl(`https://fb.watch/${shortLink}`);
const html = await fetch(url, { headers })
.then(r => r.text())
.catch(() => false)
.catch(() => false);
if (!html) return { error: 'ErrorCouldntFetch' };
const urls = []
const hd = html.match('"browser_native_hd_url":(".*?")')
const sd = html.match('"browser_native_sd_url":(".*?")')
const urls = [];
const hd = html.match('"browser_native_hd_url":(".*?")');
const sd = html.match('"browser_native_sd_url":(".*?")');
if (hd?.[1]) urls.push(JSON.parse(hd[1]))
if (sd?.[1]) urls.push(JSON.parse(sd[1]))
if (hd?.[1]) urls.push(JSON.parse(hd[1]));
if (sd?.[1]) urls.push(JSON.parse(sd[1]));
if (!urls.length) {
return { error: 'ErrorEmptyDownload' };
}
let filename = `facebook_${id || shortLink}.mp4`
const baseFilename = `facebook_${id || shortLink}`;
return {
urls: urls[0],
filename,
audioFilename: `${filename.slice(0, -4)}_audio`,
filename: `${baseFilename}.mp4`,
audioFilename: `${baseFilename}_audio`,
};
}
}

View file

@ -134,7 +134,7 @@
":username/videos/:caption/:id",
":username/videos/:id",
"reel/:id",
"share/:shortLink/:id"
"share/:shareType/:id"
],
"enabled": true
}

View file

@ -68,5 +68,6 @@ export const testers = {
patternMatch.shortLink?.length <= 11
|| patternMatch.username?.length <= 30
|| patternMatch.caption?.length <= 255
|| patternMatch.id?.length <= 20,
|| patternMatch.id?.length <= 20 && !patternMatch.shareType
|| patternMatch.id?.length <= 20 && patternMatch.shareType?.length === 1,
}