react-native-audio-browser 0.2.0-next.3 → 0.2.0-next.31

package/android/src/main/java/com/audiobrowser/player/CrossOriginHeaderStripper.kt

@@ -0,0 +1,77 @@
+package com.audiobrowser.player
+
+import okhttp3.HttpUrl
+import okhttp3.Interceptor
+import okhttp3.Request
+import okhttp3.Response
+
+/**
+ * Drops the caller's headers once a redirect leaves the origin.
+ *
+ * OkHttp does this for `Authorization` alone — RetryAndFollowUpInterceptor.buildRedirectRequest is
+ * a single `removeHeader("Authorization")` — so every other configured header, an `X-Api-Key` say,
+ * still reaches whatever host the first one named. iOS forwards none across a hop and web clears
+ * them too; this brings Android in line.
+ *
+ * Installed as a **network** interceptor, which runs once per hop. `chain.call().request()` is the
+ * call's original request, so the comparison is always against the URL the credential was addressed
+ * to rather than the hop before.
+ *
+ * Scoped to the redirect hop, and only that. An HLS segment or key fetch is its own Call, already
+ * addressed to the absolute CDN URL, and [TransformingDataSource] deliberately re-applies the
+ * config's headers to it — authenticated segments are a supported shape, and web does the same
+ * through Shaka's request filter. So this closes the leak of handing a credential to a host the
+ * caller never named; it is not a rule that the credential stays on one origin.
+ */
+internal object CrossOriginHeaderStripper : Interceptor {
+
+  /**
+   * Headers that describe the transport rather than the caller. OkHttp and media3 set these per hop
+   * — `Range` carries the seek, `Host` and `Connection` are the connection's own — so the request
+   * breaks without them. Everything else on a media request came from the media config, and is the
+   * caller's to send only to the host it addressed.
+   *
+   * `Icy-MetaData` is media3's, not the caller's: `ProgressiveMediaPeriod` asks for Shoutcast
+   * metadata through `ICY_METADATA_HEADERS` on the DataSpec — the same channel
+   * [TransformingDataSource] puts the config's headers on, so nothing downstream can tell them
+   * apart. Dropping it on a hop costs the station's `icy-metaint`, so `IcyDataSource` is never
+   * installed and `onMetadata` stops firing: live "now playing" disappears on exactly the
+   * redirecting streams this interceptor exists for, and the interleaved metadata bytes stay in the
+   * audio as audible chirping. It is a request for a response format, never a credential.
+   */
+  private val TRANSPORT_HEADERS =
+    setOf(
+      "accept",
+      "accept-encoding",
+      "connection",
+      "content-length",
+      "host",
+      "icy-metadata",
+      "range",
+      "transfer-encoding",
+      "user-agent",
+    )
+
+  override fun intercept(chain: Interceptor.Chain): Response {
+    val request = chain.request()
+    val addressed = chain.call().request().url
+    return chain.proceed(
+      if (sameOrigin(addressed, request.url)) request else stripCallerHeaders(request)
+    )
+  }
+
+  /** Scheme, host and port — the same origin test `followMediaRedirect` applies on web. */
+  internal fun sameOrigin(a: HttpUrl, b: HttpUrl): Boolean =
+    a.scheme == b.scheme && a.host == b.host && a.port == b.port
+
+  /** The request with every caller-supplied header removed. */
+  internal fun stripCallerHeaders(request: Request): Request =
+    request
+      .newBuilder()
+      .apply {
+        request.headers.names().forEach { name ->
+          if (name.lowercase() !in TRANSPORT_HEADERS) removeHeader(name)
+        }
+      }
+      .build()
+}

package/android/src/main/java/com/audiobrowser/player/MediaFactory.kt

@@ -4,10 +4,10 @@ import android.content.Context
 import androidx.media3.common.MediaItem
 import androidx.media3.datasource.DataSource
 import androidx.media3.datasource.DefaultDataSource
-import androidx.media3.datasource.DefaultHttpDataSource
 import androidx.media3.datasource.TransferListener
 import androidx.media3.datasource.cache.CacheDataSource
 import androidx.media3.datasource.cache.SimpleCache
+import androidx.media3.datasource.okhttp.OkHttpDataSource
 import androidx.media3.exoplayer.drm.DrmSessionManagerProvider
 import androidx.media3.exoplayer.source.DefaultMediaSourceFactory
 import androidx.media3.exoplayer.source.MediaSource
@@ -16,6 +16,8 @@ import androidx.media3.extractor.DefaultExtractorsFactory
 import com.audiobrowser.model.RetryPolicy
 import com.margelo.nitro.audiobrowser.MediaRequestConfig
 import java.io.IOException
+import java.util.concurrent.TimeUnit
+import okhttp3.OkHttpClient
 
 class MediaFactory(
   private val context: Context,
@@ -31,6 +33,20 @@ class MediaFactory(
 
   companion object {
     private const val DEFAULT_USER_AGENT = "react-native-audio-browser"
+
+    /**
+     * The client media requests go out on. One per process so connections are reused; not
+     * `HttpClient`'s browse client, whose read timeout is sized for JSON and would cut a long media
+     * read short. The timeouts are media3's own defaults, so stall detection and
+     * [RetryLoadErrorHandlingPolicy] behave as they did before.
+     */
+    private val mediaHttpClient: OkHttpClient by lazy {
+      OkHttpClient.Builder()
+        .connectTimeout(8, TimeUnit.SECONDS)
+        .readTimeout(8, TimeUnit.SECONDS)
+        .addNetworkInterceptor(CrossOriginHeaderStripper)
+        .build()
+    }
   }
 
   private val extractorsFactory =
@@ -95,17 +111,19 @@ class MediaFactory(
     // ExoPlayer's IO thread. This prevents deadlocks when the JS thread is blocked by
     // synchronous Nitro calls (e.g., seekTo) while a media transform callback needs the
     // JS thread to resolve.
+
+    // OkHttp rather than DefaultHttpDataSource, for how each treats a redirect.
+    // DefaultHttpDataSource re-applies the request headers on every hop, handing
+    // an Authorization header to whatever host the first one named. OkHttp drops
+    // that one header itself, and [CrossOriginHeaderStripper] drops the rest.
     val httpFactory =
-      DefaultHttpDataSource.Factory().apply {
-        // Deliberately NOT setUserAgent(): DefaultHttpDataSource applies the factory
-        // user-agent as a FINAL setRequestProperty("User-Agent", …) that runs after —
-        // and overrides — the per-request DataSpec headers. That would clobber the
-        // User-Agent TransformingDataSource sets per request (the whole point of the
-        // per-request userAgent override). Supplying the same value as a default
-        // request property keeps the default for un-overridden requests while letting
-        // the per-request DataSpec header win.
+      OkHttpDataSource.Factory(mediaHttpClient).apply {
+        // Deliberately NOT setUserAgent(): it is applied last via addHeader(),
+        // which appends, so a request already carrying one would send two. As a
+        // default request property it is merged under dataSpec.httpRequestHeaders
+        // and applied with header(), letting TransformingDataSource's per-request
+        // override win.
         setDefaultRequestProperties(mapOf("User-Agent" to DEFAULT_USER_AGENT))
-        setAllowCrossProtocolRedirects(true)
         // Connect transfer listener for bandwidth measurement
         transferListener?.let { setTransferListener(it) }
       }