nixamp 0.7.18 → 0.7.19

package/dist/server.js

@@ -775,10 +775,17 @@ export function createHandler(engine, options) {
         // cookie, so every later fetch, EventSource and <audio src> carries it
         // without the page knowing anything about keys. Either key works here, and
         // which one was used decides what the browser can then do.
-        const offeredInPath = key !== null ? keyInPath(path) : null;
-        if (offeredInPath !== null) {
-            const offered = offeredInPath;
-            if (scopeOf(offered, key, listenKey) === null) {
+        const inPath = key !== null ? keyInPath(path) : null;
+        if (inPath !== null) {
+            const offered = inPath.key;
+            // The path has to be telling the truth about the key it carries. A `/v/`
+            // link holding the control key would read as view-only to whoever you
+            // sent it to and hand them the controls, which is the whole reason for
+            // naming the two shapes in the first place.
+            //
+            // A mismatch answers exactly as a wrong key does, so nothing is learned
+            // from the difference between the two.
+            if (scopeOf(offered, key, listenKey) !== inPath.wants) {
                 json(response, 404, { error: "not found" });
                 return;
             }

package/dist/share.d.ts

@@ -94,8 +94,19 @@ export declare function reachableAddresses(host: string, port: number, publicUrl
  * A link should say what it is before anybody clicks it.
  */
 export declare const KEY_PATHS: readonly ["/a/", "/v/"];
-/** The key in a share link, whichever of the three shapes it came in. */
-export declare function keyInPath(path: string): string | null;
+/**
+ * The key in a share link, and what the link claimed to be.
+ *
+ * Both halves, because a label nobody checks is a label that can lie. `/a/`
+ * means this administers and `/v/` means this only views; handed the other
+ * key, a path would otherwise have said one thing and done the other -- and
+ * the dangerous direction is real: a `/v/` link built around the control key
+ * reads as view-only to the person you send it to and hands them the controls.
+ */
+export declare function keyInPath(path: string): {
+    key: string;
+    wants: Scope;
+} | null;
 /** The full link, key and all. `admin` picks the shape that says which it is. */
 export declare function shareLink(base: string, key: string | null, admin?: boolean): string;
 /**

package/dist/share.js

@@ -251,7 +251,15 @@ export function reachableAddresses(host, port, publicUrl = "", scheme = "http")
  * A link should say what it is before anybody clicks it.
  */
 export const KEY_PATHS = ["/a/", "/v/"];
-/** The key in a share link, whichever of the three shapes it came in. */
+/**
+ * The key in a share link, and what the link claimed to be.
+ *
+ * Both halves, because a label nobody checks is a label that can lie. `/a/`
+ * means this administers and `/v/` means this only views; handed the other
+ * key, a path would otherwise have said one thing and done the other -- and
+ * the dangerous direction is real: a `/v/` link built around the control key
+ * reads as view-only to the person you send it to and hands them the controls.
+ */
 export function keyInPath(path) {
     for (const prefix of KEY_PATHS) {
         if (!path.startsWith(prefix))
@@ -259,12 +267,15 @@ export function keyInPath(path) {
         const rest = path.slice(prefix.length).replace(/\/+$/, "");
         if (rest === "" || rest.includes("/"))
             return null;
+        let key = rest;
         try {
-            return decodeURIComponent(rest);
+            key = decodeURIComponent(rest);
         }
         catch {
-            return rest;
+            // A key that is not valid percent-encoding is taken as written; it will
+            // fail to match anything, which is the right answer either way.
         }
+        return { key, wants: prefix === "/a/" ? "control" : "listen" };
     }
     return null;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nixamp",
-  "version": "0.7.18",
+  "version": "0.7.19",
   "description": "It really whips the terminal's ass. A Winamp-shaped audio player for your terminal.",
   "license": "MIT",
   "type": "module",

package/src/server.ts

@@ -1074,10 +1074,17 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
     // cookie, so every later fetch, EventSource and <audio src> carries it
     // without the page knowing anything about keys. Either key works here, and
     // which one was used decides what the browser can then do.
-    const offeredInPath = key !== null ? keyInPath(path) : null;
-    if (offeredInPath !== null) {
-      const offered = offeredInPath;
-      if (scopeOf(offered, key, listenKey) === null) {
+    const inPath = key !== null ? keyInPath(path) : null;
+    if (inPath !== null) {
+      const offered = inPath.key;
+      // The path has to be telling the truth about the key it carries. A `/v/`
+      // link holding the control key would read as view-only to whoever you
+      // sent it to and hand them the controls, which is the whole reason for
+      // naming the two shapes in the first place.
+      //
+      // A mismatch answers exactly as a wrong key does, so nothing is learned
+      // from the difference between the two.
+      if (scopeOf(offered, key, listenKey) !== inPath.wants) {
         json(response, 404, { error: "not found" });
         return;
       }

package/src/share.ts

@@ -282,17 +282,28 @@ export function reachableAddresses(
  */
 export const KEY_PATHS = ["/a/", "/v/"] as const;
 
-/** The key in a share link, whichever of the three shapes it came in. */
-export function keyInPath(path: string): string | null {
+/**
+ * The key in a share link, and what the link claimed to be.
+ *
+ * Both halves, because a label nobody checks is a label that can lie. `/a/`
+ * means this administers and `/v/` means this only views; handed the other
+ * key, a path would otherwise have said one thing and done the other -- and
+ * the dangerous direction is real: a `/v/` link built around the control key
+ * reads as view-only to the person you send it to and hands them the controls.
+ */
+export function keyInPath(path: string): { key: string; wants: Scope } | null {
   for (const prefix of KEY_PATHS) {
     if (!path.startsWith(prefix)) continue;
     const rest = path.slice(prefix.length).replace(/\/+$/, "");
     if (rest === "" || rest.includes("/")) return null;
+    let key = rest;
     try {
-      return decodeURIComponent(rest);
+      key = decodeURIComponent(rest);
     } catch {
-      return rest;
+      // A key that is not valid percent-encoding is taken as written; it will
+      // fail to match anything, which is the right answer either way.
     }
+    return { key, wants: prefix === "/a/" ? "control" : "listen" };
   }
   return null;
 }

package/web/dist/sw.js

@@ -1,5 +1,5 @@
 /* nixamp service worker — generated, do not edit */
-const CACHE = "nixamp-1788963208633";
+const CACHE = "nixamp-1788964111536";
 const PRECACHE = [
   "/",
   "/apple-touch-icon.png",