@warren-bank/hls-proxy 3.6.0 → 3.6.1

package/hls-proxy/acl_pass.js

@@ -1,17 +1,15 @@
 const expressjs = require('./expressjs_utils')
 const {URL}     = require('./url')
 
-const get_encoded_qs_password = function(req) {
-  const req_url = new URL( expressjs.get_full_req_url(req) )
-
-  return req_url.searchParams.get('password') || ''
+const get_decoded_qs_password = function(req) {
+  return expressjs.get_proxy_req_query(req, 'password', false)
 }
 
 const is_allowed = function(params, req) {
   const {acl_pass} = params
 
   if (acl_pass && Array.isArray(acl_pass) && acl_pass.length) {
-    const password = decodeURIComponent( get_encoded_qs_password(req) )
+    const password = get_decoded_qs_password(req)
 
     return (acl_pass.indexOf(password) >= 0)
   }
@@ -20,6 +18,6 @@ const is_allowed = function(params, req) {
 }
 
 module.exports = {
-  get_encoded_qs_password,
+  get_decoded_qs_password,
   is_allowed
 }

package/hls-proxy/expressjs_utils.js

@@ -1,4 +1,4 @@
-const {URL} = require('./url')
+const {URL, decode_component_value} = require('./url')
 
 const get_full_req_url = function(req) {
   return req.originalUrl || req.url
@@ -19,16 +19,15 @@ const get_proxy_req_url = function(req) {
     : req.url
 }
 
-const get_proxy_req_query = function(req, key) {
+const get_proxy_req_query = function(req, key, is_base64) {
   if (has_req_param(req, key))
-    return req.params[key]
+    return decode_component_value(req.params[key], false, is_base64, is_base64)
 
   if (has_req_query(req, key))
-    return req.query[key]
+    return decode_component_value(req.query[key], false, is_base64, is_base64)
 
-  const url = new URL(req.url)
-  const qs  = url.searchParams
-  return qs.get(key)
+  const req_url = new URL(get_full_req_url(req))
+  return decode_component_value(req_url.searchParams.get(key), true, is_base64, is_base64)
 }
 
 const get_base_req_url = function(req) {

package/hls-proxy/proxy.js

@@ -55,7 +55,7 @@ const get_middleware = function(params) {
       return
     }
 
-    const qs_password = acl_pass.get_encoded_qs_password(req)
+    const qs_password = acl_pass.get_decoded_qs_password(req)
     const is_m3u8     = (url_type === 'm3u8')
 
     const send_cache_segment = function(segment, type) {

package/hls-proxy/url.js

@@ -25,7 +25,23 @@ if (!parse || !URL) {
   throw new Error('URL class is not supported')
 }
 
+const decode_component_value = function(value, decode = true, fix_unsafe_url_base64_encoding = false, fix_safe_url_base64_encoding = false) {
+  value = value || ''
+
+  if (decode)
+    value = decodeURIComponent(value)
+
+  if (fix_unsafe_url_base64_encoding)
+    value = value.replace(/ /g, '+')
+
+  if (fix_safe_url_base64_encoding)
+    value = value.replace(/-/g, '+').replace(/_/g, '/')
+
+  return value
+}
+
 module.exports = {
   parse,
-  URL
+  URL,
+  decode_component_value
 }

package/hls-proxy/utils.js

@@ -1,5 +1,5 @@
 const expressjs = require('./expressjs_utils')
-const parse_url = require('./url').parse
+const {parse: parse_url, decode_component_value: decode_url_component_value} = require('./url')
 
 const regexs = {
   req_url: new RegExp('^(.*?)/([a-zA-Z0-9\\+/=%]+)(?:[\\._]([^/\\?#]*))?(?:[\\?#].*)?$'),
@@ -38,7 +38,7 @@ const parse_req_url = function(params, req) {
 
     let url, url_lc, index
 
-    url    = base64_decode( decodeURIComponent( matches[2] ) ).trim()
+    url    = base64_decode( decode_url_component_value( matches[2], true, true, true ) ).trim()
     url_lc = url.toLowerCase()
     index  = url_lc.indexOf('http')
 
@@ -57,10 +57,10 @@ const parse_req_url = function(params, req) {
       result.url = url
     }
 
-    let qs_headers = expressjs.get_proxy_req_query(req, 'headers')
+    let qs_headers = expressjs.get_proxy_req_query(req, 'headers', true)
     if (qs_headers) {
       try {
-        qs_headers = base64_decode( decodeURIComponent( qs_headers ) ).trim()
+        qs_headers = base64_decode( qs_headers ).trim()
         qs_headers = JSON.parse(qs_headers)
 
         if (qs_headers && (qs_headers instanceof Object))

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@warren-bank/hls-proxy",
   "description": "Node.js server to proxy HLS video streams",
-  "version":     "3.6.0",
+  "version":     "3.6.1",
   "scripts": {
     "start":     "node hls-proxy/bin/hlsd.js",
     "sudo": "sudo node hls-proxy/bin/hlsd.js"