Michael/xtremflow
1
0 Fork 0
mirror of https://github.com/R0m1k3/xtremflow.git synced 2026-10-11 17:30:00 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(stream): validate streamId AFTER stripping extension

Browse Source
This commit is contained in:
Michael committed 2026-01-07 09:23:37 +01:00
1 parent e0612ba67f
commit 5ad3ad9f9e
1 file changed
+7 -8
Download Patch File Download Diff File Expand all files Collapse all files
bin/api/streaming_handler.dart
+7 -8
View File
@@ -127,20 +127,19 @@ Handler createLiveStreamHandler(
router.get('/<streamId|.*>', (Request request, String streamId) async {
print('[Live] Incoming request for streamId: $streamId');
// Validate streamId to prevent Path Traversal
if (!RegExp(r'^[a-zA-Z0-9_-]+$').hasMatch(streamId)) {
print('[Live] Invalid streamId: $streamId');
return Response.badRequest(body: 'Invalid stream ID');
}
// Remove .ts extension if present
// Remove extension if present (handle both .ts and .m3u8 just in case)
// Remove extension if present FIRST (handle both .ts and .m3u8)
if (streamId.endsWith('.ts')) {
streamId = streamId.substring(0, streamId.length - 3);
} else if (streamId.endsWith('.m3u8')) {
streamId = streamId.substring(0, streamId.length - 5);
}
// Validate streamId to prevent Path Traversal (AFTER extension removal)
if (!RegExp(r'^[a-zA-Z0-9_-]+$').hasMatch(streamId)) {
print('[Live] Invalid streamId: $streamId');
return Response.badRequest(body: 'Invalid stream ID');
}
final playlist = await getPlaylist(request);
if (playlist == null) {