winston icon indicating copy to clipboard operation
winston copied to clipboard

[BUG] Inadequate checking of domains when loading video media with custom loaders (streamable)

Open robigan opened this issue 5 months ago • 2 comments

I was reviewing the code that handles loading of media, and noticed that in Winston, the check for if media can be loaded using Streamable simply checks the url string for the presence of streamable.com

https://github.com/lo-cafe/winston/blob/8447b13b706ce205bdba8f758eddd2848368b4d3/winston/components/Media/mediaExtractor.swift#L180-L182

Additionally, the extractor doesn't check for the presence of a valid video ID slug, or that the streamable.com link isn't another landing page/non-video page like their landing page https://streamable.com/pricing, with the extractor returning an empty string if a leading slash is present and the domain being returned if there are no path delimiters in the URL (in which case leads to Winston trying to load a streamable video with ID streamable.com).

https://github.com/lo-cafe/winston/blob/8447b13b706ce205bdba8f758eddd2848368b4d3/winston/components/Media/mediaExtractor.swift#L59

I see that right below, the URL is eventually parsed and then hosts are checked properly there, my suggestion would be to properly check the host component of the URL and only send the path component to the extractor.

robigan avatar Sep 17 '24 19:09 robigan