shaka-player 3.3.10 → 3.3.12

package/lib/util/platform.js

@@ -163,6 +163,40 @@ shaka.util.Platform = class {
     return shaka.util.Platform.userAgentContains_('CrKey');
   }
 
+  /**
+   * Check if the current platform is a Android-based Cast devices.
+   *
+   * @return {boolean}
+   */
+  static isAndroidCastDevice() {
+    return shaka.util.Platform.isChromecast() &&
+        shaka.util.Platform.userAgentContains_('Android');
+  }
+
+  /**
+   * Returns a major version number for Chrome, or Chromium-based browsers.
+   *
+   * For example:
+   *   - Chrome 106.0.5249.61 returns 106.
+   *   - Edge 106.0.1370.34 returns 106 (since this is based on Chromium).
+   *   - Safari returns null (since this is independent of Chromium).
+   *
+   * @return {?number} A major version number or null if not Chromium-based.
+   */
+  static chromeVersion() {
+    if (!shaka.util.Platform.userAgentContains_('Chrome')) {
+      return null;
+    }
+
+    // Looking for something like "Chrome/106.0.0.0".
+    const match = navigator.userAgent.match(/Chrome\/(\d+)/);
+    if (match) {
+      return parseInt(match[1], /* base= */ 10);
+    }
+
+    return null;
+  }
+
   /**
    * Check if the current platform is Google Chrome.
    *

package/lib/util/stream_utils.js

@@ -467,7 +467,8 @@ shaka.util.StreamUtils = class {
       if (shaka.util.Platform.isXboxOne() && video &&
           ((video.width && video.width > 1920) ||
           (video.height && video.height > 1080)) &&
-          video.codecs.includes('avc1.')) {
+          (video.codecs.includes('avc1.') ||
+          video.codecs.includes('avc3.'))) {
         shaka.log.debug('Dropping variant - not compatible with platform',
             shaka.util.StreamUtils.getVariantSummaryString_(variant));
         return false;

package/lib/util/xml_utils.js

@@ -8,6 +8,7 @@ goog.provide('shaka.util.XmlUtils');
 
 goog.require('goog.asserts');
 goog.require('shaka.log');
+goog.require('shaka.util.Lazy');
 goog.require('shaka.util.StringUtils');
 
 
@@ -348,19 +349,21 @@ shaka.util.XmlUtils = class {
    */
   static parseXmlString(xmlString, expectedRootElemName) {
     const parser = new DOMParser();
-    let xml = null;
+    const unsafeXmlString =
+        shaka.util.XmlUtils.trustedHTMLFromString_.value()(xmlString);
+    let unsafeXml = null;
     try {
-      xml = parser.parseFromString(xmlString, 'text/xml');
+      unsafeXml = parser.parseFromString(unsafeXmlString, 'text/xml');
     } catch (exception) {
       shaka.log.error('XML parsing exception:', exception);
       return null;
     }
 
     // According to MDN, parseFromString never returns null.
-    goog.asserts.assert(xml, 'Parsed XML document cannot be null!');
+    goog.asserts.assert(unsafeXml, 'Parsed XML document cannot be null!');
 
     // Check for empty documents.
-    const rootElem = xml.documentElement;
+    const rootElem = unsafeXml.documentElement;
     if (!rootElem) {
       shaka.log.error('XML document was empty!');
       return null;
@@ -374,13 +377,28 @@ shaka.util.XmlUtils = class {
     }
 
     // The top-level element in the loaded XML should have the name we expect.
-    if (xml.documentElement.tagName != expectedRootElemName) {
+    if (rootElem.tagName != expectedRootElemName) {
       shaka.log.error(
           `XML tag name does not match expected "${expectedRootElemName}":`,
-          xml.documentElement.tagName);
+          rootElem.tagName);
       return null;
     }
 
+    // SECURITY: Verify that the document does not contain elements from the
+    // HTML or SVG namespaces, which could trigger script execution and XSS.
+    const iterator = document.createNodeIterator(
+        unsafeXml,
+        NodeFilter.SHOW_ALL,
+    );
+    let currentNode;
+    while (currentNode = iterator.nextNode()) {
+      if (currentNode instanceof HTMLElement ||
+          currentNode instanceof SVGElement) {
+        shaka.log.error('XML document embeds unsafe content!');
+        return null;
+      }
+    }
+
     return rootElem;
   }
 
@@ -402,3 +420,24 @@ shaka.util.XmlUtils = class {
     }
   }
 };
+
+/**
+ * Promote a string to TrustedHTML. This function is security-sensitive and
+ * should only be used with security approval where the string is guaranteed not
+ * to cause an XSS vulnerability.
+ *
+ * @private {!shaka.util.Lazy.<function(!string): (!TrustedHTML|!string)>}
+ */
+shaka.util.XmlUtils.trustedHTMLFromString_ = new shaka.util.Lazy(() => {
+  if (typeof trustedTypes !== 'undefined') {
+    // Create a Trusted Types policy for promoting the string to TrustedHTML.
+    // The Lazy wrapper ensures this policy is only created once.
+    const policy = trustedTypes.createPolicy('shaka-player#xml', {
+      createHTML: (s) => s,
+    });
+    return (s) => policy.createHTML(s);
+  }
+  // Fall back to strings in environments that don't support Trusted Types.
+  return (s) => s;
+});
+

package/maintained-branches.md

@@ -2,8 +2,8 @@
 
 We are currently maintaining the following branches of Shaka Player:
 
- - v4.1 (latest)
- - v4.0 (previous)
+ - v4.2 (latest)
+ - v4.1 (previous)
  - v3.3 (LTS until April 30, 2023)
  - v3.2 (in use by the Cast Application Framework)
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "shaka-player",
   "description": "DASH/EME video player library",
-  "version": "3.3.10",
+  "version": "3.3.12",
   "homepage": "https://github.com/shaka-project/shaka-player",
   "author": "Google",
   "maintainers": [

package/test/cea/cea608_memory_unit.js

@@ -295,5 +295,93 @@ describe('Cea608Memory', () => {
       const caption = memory.forceEmit(startTime, endTime);
       expect(caption).toEqual(expectedCaption);
     });
+
+    it('does not move rows if source row index is negative', () => {
+      const startTime = 1;
+      const endTime = 2;
+      const text = 'test';
+
+      // Add the text to the buffer, each character on separate rows.
+      // At this point, the memory looks like:
+      // [1]: t
+      // [2]: e
+      // [3]: s
+      // [4]: t
+      for (const c of text) {
+        memory.addChar(CharSet.BASIC_NORTH_AMERICAN,
+            c.charCodeAt(0));
+        memory.setRow(memory.getRow() + 1); // increment row
+      }
+
+      const srcRowIdx = -1;
+      const dstRowIdx = 2;
+      const rowsToMove = 3;
+      memory.moveRows(dstRowIdx, srcRowIdx, rowsToMove);
+
+      // Expected text is 't\ne\ns\nt'
+      const topLevelCue = new shaka.text.Cue(startTime, endTime, '');
+      topLevelCue.nestedCues = [
+        CeaUtils.createDefaultCue(startTime, endTime, 't'),
+        CeaUtils.createLineBreakCue(startTime, endTime),
+        CeaUtils.createDefaultCue(startTime, endTime, 'e'),
+        CeaUtils.createLineBreakCue(startTime, endTime),
+        CeaUtils.createDefaultCue(startTime, endTime, 's'),
+        CeaUtils.createLineBreakCue(startTime, endTime),
+        CeaUtils.createDefaultCue(startTime, endTime, 't'),
+      ];
+
+      const expectedCaption = {
+        stream,
+        cue: topLevelCue,
+      };
+
+      // Force out the new memory.
+      const caption = memory.forceEmit(startTime, endTime);
+      expect(caption).toEqual(expectedCaption);
+    });
+
+    it('does not move rows if destination row index is negative', () => {
+      const startTime = 1;
+      const endTime = 2;
+      const text = 'test';
+
+      // Add the text to the buffer, each character on separate rows.
+      // At this point, the memory looks like:
+      // [1]: t
+      // [2]: e
+      // [3]: s
+      // [4]: t
+      for (const c of text) {
+        memory.addChar(CharSet.BASIC_NORTH_AMERICAN,
+            c.charCodeAt(0));
+        memory.setRow(memory.getRow() + 1); // increment row
+      }
+
+      const srcRowIdx = 1;
+      const dstRowIdx = -2;
+      const rowsToMove = 3;
+      memory.moveRows(dstRowIdx, srcRowIdx, rowsToMove);
+
+      // Expected text is 't\ne\ns\nt'
+      const topLevelCue = new shaka.text.Cue(startTime, endTime, '');
+      topLevelCue.nestedCues = [
+        CeaUtils.createDefaultCue(startTime, endTime, 't'),
+        CeaUtils.createLineBreakCue(startTime, endTime),
+        CeaUtils.createDefaultCue(startTime, endTime, 'e'),
+        CeaUtils.createLineBreakCue(startTime, endTime),
+        CeaUtils.createDefaultCue(startTime, endTime, 's'),
+        CeaUtils.createLineBreakCue(startTime, endTime),
+        CeaUtils.createDefaultCue(startTime, endTime, 't'),
+      ];
+
+      const expectedCaption = {
+        stream,
+        cue: topLevelCue,
+      };
+
+      // Force out the new memory.
+      const caption = memory.forceEmit(startTime, endTime);
+      expect(caption).toEqual(expectedCaption);
+    });
   });
 });

package/test/media/streaming_engine_integration.js

@@ -90,17 +90,17 @@ describe('StreamingEngine', () => {
 
     segmentAvailability = {
       start: 0,
-      end: 60,
+      end: 40,
     };
 
     timeline = shaka.test.StreamingEngineUtil.createFakePresentationTimeline(
         segmentAvailability,
-        /* presentationDuration= */ 60,
+        /* presentationDuration= */ 40,
         /* maxSegmentDuration= */ metadata.video.segmentDuration,
         /* isLive= */ false);
 
     setupNetworkingEngine(
-        /* presentationDuration= */ 60,
+        /* presentationDuration= */ 40,
         {
           audio: metadata.audio.segmentDuration,
           video: metadata.video.segmentDuration,
@@ -108,8 +108,8 @@ describe('StreamingEngine', () => {
 
     setupManifest(
         /* firstPeriodStartTime= */ 0,
-        /* secondPeriodStartTime= */ 30,
-        /* presentationDuration= */ 60);
+        /* secondPeriodStartTime= */ 20,
+        /* presentationDuration= */ 40);
 
     setupPlayhead();
 
@@ -263,10 +263,11 @@ describe('StreamingEngine', () => {
       streamingEngine.switchVariant(variant);
       await streamingEngine.start();
       video.play();
-      // The overall test timeout is 120 seconds, and the content is 60
+      // The overall test timeout is 120 seconds, and the content is 40
       // seconds.  It should be possible to complete this test in 100 seconds,
       // and if not, we want the error thrown to be within the overall test's
-      // timeout window.
+      // timeout window.  Note that we have seen some devices fail to play at
+      // full speed for reasons beyond our control, so we plan for >= 0.5x.
       await waiter.timeoutAfter(100).waitForEnd(video);
     });
 

package/test/offline/offline_integration.js

@@ -68,7 +68,7 @@ filterDescribe('Offline', supportsStorage, () => {
     await player.load(contentUri);
 
     video.play();
-    await playTo(/* end= */ 3, /* timeout= */ 10);
+    await playTo(/* end= */ 3, /* timeout= */ 20);
     await player.unload();
     await storage.remove(contentUri);
   });
@@ -104,7 +104,7 @@ filterDescribe('Offline', supportsStorage, () => {
         await player.load(contentUri);
 
         video.play();
-        await playTo(/* end= */ 3, /* timeout= */ 10);
+        await playTo(/* end= */ 3, /* timeout= */ 20);
         await player.unload();
         await storage.remove(contentUri);
       });
@@ -147,7 +147,7 @@ filterDescribe('Offline', supportsStorage, () => {
         await player.load(contentUri);
 
         video.play();
-        await playTo(/* end= */ 3, /* timeout= */ 10);
+        await playTo(/* end= */ 3, /* timeout= */ 20);
         await player.unload();
         await storage.remove(contentUri);
       });

package/test/offline/storage_integration.js

@@ -1034,6 +1034,36 @@ filterDescribe('Storage', storageSupport, () => {
       }
     });
 
+    /**
+     * In some situations, indexedDB.open() can just hang, and call neither the
+     * 'success' nor the 'error' callbacks.
+     * I'm not sure what causes it, but it seems to happen consistently between
+     * reloads when it does so it might be a browser-based issue.
+     * In that case, we should time out with an error, instead of also hanging.
+     */
+    it('throws an error if indexedDB open times out', async () => {
+      const oldOpen = window.indexedDB.open;
+      window.indexedDB.open = () => {
+        // Just return a dummy object.
+        return /** @type {!IDBOpenDBRequest} */ ({
+          onsuccess: (event) => {},
+          onerror: (error) => {},
+        });
+      };
+
+      /** @type {!shaka.offline.StorageMuxer} */
+      const muxer = new shaka.offline.StorageMuxer();
+      const expectedError = shaka.test.Util.jasmineError(new shaka.util.Error(
+          shaka.util.Error.Severity.CRITICAL,
+          shaka.util.Error.Category.STORAGE,
+          shaka.util.Error.Code.INDEXED_DB_INIT_TIMED_OUT));
+
+      await expectAsync(muxer.init())
+          .toBeRejectedWith(expectedError);
+
+      window.indexedDB.open = oldOpen;
+    });
+
     it('throws an error if the content is a live stream', async () => {
       const expected = Util.jasmineError(new shaka.util.Error(
           shaka.util.Error.Severity.CRITICAL,

package/test/test/util/ttml_utils.js

@@ -51,8 +51,6 @@ shaka.test.TtmlUtils = class {
         region,
         nestedCues: jasmine.any(Object),
         payload: '',
-        startTime: 0,
-        endTime: Infinity,
         isContainer: true,
       });
       Object.assign(containerCue, properties);

package/test/text/ttml_text_parser_unit.js

@@ -1535,6 +1535,52 @@ describe('TtmlTextParser', () => {
         {startTime: 1, endTime: 2});
   });
 
+  // Regression test for #4468
+  it('defaults the body background to transparent', () => {
+    verifyHelper(
+        // One cue, don't care about the details
+        [{}],
+        '<tt xmlns:tts="http://www.w3.org/ns/ttml#styling">' +
+        '<head>' +
+        '<styling>' +
+        '<style xml:id="s1" tts:backgroundColor="black" />' +
+        '</styling>' +
+        '</head>' +
+        '<body><div>' +
+        '<p begin="00:01.00" end="00:02.00">' +
+        '<span style="s1">Test</span>' +
+        '</p>' +
+        '</div></body></tt>',
+        {periodStart: 0, segmentStart: 0, segmentEnd: 0, vttOffset: 0},
+        // The body must have these properties:
+        {backgroundColor: 'transparent'},
+        // The div must have these properties:
+        {});  // don't care
+  });
+
+  // Regression test for #4468
+  it('allows the body background color to be set', () => {
+    verifyHelper(
+        // One cue, don't care about the details
+        [{}],
+        '<tt xmlns:tts="http://www.w3.org/ns/ttml#styling">' +
+        '<head>' +
+        '<styling>' +
+        '<style xml:id="s1" tts:backgroundColor="black" />' +
+        '</styling>' +
+        '</head>' +
+        '<body style="s1"><div>' +
+        '<p begin="00:01.00" end="00:02.00">' +
+        '<span>Test</span>' +
+        '</p>' +
+        '</div></body></tt>',
+        {periodStart: 0, segmentStart: 0, segmentEnd: 0, vttOffset: 0},
+        // The body must have these properties:
+        {backgroundColor: 'black'},
+        // The div must have these properties:
+        {});  // don't care
+  });
+
   it('parses wrapping option', () => {
     verifyHelper(
         [

package/test/ui/text_displayer_layout_unit.js

@@ -219,6 +219,21 @@ filterDescribe('TextDisplayer layout', supportsScreenshots, () => {
 
   /** @param {string} prefix Prepended to screenshot names */
   function defineTests(prefix) {
+    // Due to a Safari implementation bug, the browser only does the correct
+    // thing for "end-time-edge-case" on Safari 16+.  Skip the tests on earlier
+    // versions.
+    const safariVersion = shaka.util.Platform.safariVersion();
+    if (prefix == 'native' && safariVersion && safariVersion < 16) {
+      return;
+    }
+
+    // Due to updates in the rendering and/or default styles in Chrome, the
+    // screenshots for native rendering only match in Chrome 106+.
+    const chromeVersion = shaka.util.Platform.chromeVersion();
+    if (prefix == 'native' && chromeVersion && chromeVersion < 106) {
+      return;
+    }
+
     it('basic cue', async () => {
       textDisplayer.append([
         new shaka.text.Cue(0, 1, 'Captain\'s log, stardate 41636.9'),
@@ -262,8 +277,8 @@ filterDescribe('TextDisplayer layout', supportsScreenshots, () => {
 
     // Regression test for #3151
     // Only one cue should be displayed.  Note, however, that we don't control
-    // this in a browser's native display.  As of Feb 2021, only Firefox does
-    // the right thing in native text display.  Chrome, Edge, and Safari all
+    // this in a browser's native display.  As of Sep 2022, both Firefox and
+    // Safari>=16 do the right thing in native text display.  Chrome and Edge
     // show both cues in this edge case.  When we control the display of text
     // through the UI & DOM, we can always get the timing right.
     it('cues ending exactly now', async () => {

package/test/util/periods_unit.js

@@ -12,6 +12,14 @@ describe('PeriodCombiner', () => {
   /** @type {shaka.util.PeriodCombiner} */
   let combiner;
 
+  const makeAudioStreamWithRoles = (id, roles, primary = true) => {
+    const stream = makeAudioStream('en');
+    stream.originalId = id;
+    stream.roles = roles;
+    stream.primary = primary;
+    return stream;
+  };
+
   beforeEach(() => {
     combiner = new shaka.util.PeriodCombiner();
   });
@@ -1127,20 +1135,149 @@ describe('PeriodCombiner', () => {
     const variants = combiner.getVariants();
 
     expect(variants).toEqual(jasmine.arrayWithExactContents([
-      makeAVVariant(1080, 'en'),
-      makeAVVariant(1080, 'en'),
+      makeAVVariant(1080, 'en', 2, ['role1', 'role2']),
+      makeAVVariant(1080, 'en', 2, ['role1']),
     ]));
 
     // We can use the originalId field to see what each track is composed of.
-    const audio1 = variants[0].audio;
-    expect(audio1.roles).toEqual(['role1', 'role2']);
-    expect(audio1.originalId).toBe('stream1,stream3');
+    expect(variants[0].audio.originalId).toBe('stream1,stream3');
+    expect(variants[1].audio.originalId).toBe('stream2,stream4');
+  });
 
-    const audio2 = variants[1].audio;
-    expect(audio2.roles).toEqual(['role1']);
-    expect(audio2.originalId).toBe('stream2,stream4');
+  it('Matches streams with roles in common', async () => {
+    /** @type {!Array.<shaka.util.PeriodCombiner.Period>} */
+    const periods = [
+      {
+        id: '1',
+        videoStreams: [
+          makeVideoStream(720),
+          makeVideoStream(1080),
+        ],
+        audioStreams: [
+          makeAudioStreamWithRoles('stream1', ['main']),
+          makeAudioStreamWithRoles('stream2', ['description'], false),
+        ],
+        textStreams: [],
+        imageStreams: [],
+      },
+      {
+        id: '2',
+        videoStreams: [
+          makeVideoStream(720),
+          makeVideoStream(1080),
+        ],
+        audioStreams: [
+          makeAudioStreamWithRoles('stream1', ['main']),
+          makeAudioStreamWithRoles('stream2', ['description'], false),
+        ],
+        textStreams: [],
+        imageStreams: [],
+      },
+    ];
+
+    await combiner.combinePeriods(periods, /* isDynamic= */ false);
+    const variants = combiner.getVariants();
+
+    console.log(variants);
+
+    expect(variants.length).toBe(4);
+
+    expect(variants).toEqual(jasmine.arrayWithExactContents([
+      makeAVVariant(720, 'en', 2, ['main']),
+      makeAVVariant(1080, 'en', 2, ['main']),
+      makeAVVariant(720, 'en', 2, ['description']),
+      makeAVVariant(1080, 'en', 2, ['description']),
+    ]));
+
+    // We can use the originalId field to see what each track is composed of.
+    expect(variants[0].audio.originalId).toBe('stream1,stream1');
+    expect(variants[1].audio.originalId).toBe('stream1,stream1');
+    expect(variants[2].audio.originalId).toBe('stream2,stream2');
+    expect(variants[3].audio.originalId).toBe('stream2,stream2');
   });
 
+  it('Matches streams with mismatched roles', async () => {
+    /** @type {!Array.<shaka.util.PeriodCombiner.Period>} */
+    const periods = [
+      {
+        id: '0',
+        videoStreams: [
+          makeVideoStream(720),
+          makeVideoStream(1080),
+        ],
+        audioStreams: [
+          makeAudioStreamWithRoles('stream1', ['main']),
+        ],
+        textStreams: [],
+        imageStreams: [],
+      },
+      {
+        id: '1',
+        videoStreams: [
+          makeVideoStream(720),
+          makeVideoStream(1080),
+        ],
+        audioStreams: [
+          makeAudioStreamWithRoles('stream1', ['main']),
+          makeAudioStreamWithRoles('stream2', ['description'], false),
+        ],
+        textStreams: [],
+        imageStreams: [],
+      },
+      {
+        id: '2',
+        videoStreams: [
+          makeVideoStream(720),
+          makeVideoStream(1080),
+        ],
+        audioStreams: [
+          makeAudioStreamWithRoles('stream1', ['main']),
+        ],
+        textStreams: [],
+        imageStreams: [],
+      },
+      {
+        id: '3',
+        videoStreams: [
+          makeVideoStream(720),
+          makeVideoStream(1080),
+        ],
+        audioStreams: [
+          makeAudioStreamWithRoles('stream1', ['main']),
+          makeAudioStreamWithRoles('stream2', ['description'], false),
+        ],
+        textStreams: [],
+        imageStreams: [],
+      },
+    ];
+
+    await combiner.combinePeriods(periods, /* isDynamic= */ false);
+    const variants = combiner.getVariants();
+
+    console.log(variants);
+
+    expect(variants.length).toBe(4);
+
+    expect(variants).toEqual(jasmine.arrayWithExactContents([
+      makeAVVariant(720, 'en', 2, ['main']),
+      makeAVVariant(1080, 'en', 2, ['main']),
+      makeAVVariant(720, 'en', 2, ['description', 'main']),
+      makeAVVariant(1080, 'en', 2, ['description', 'main']),
+    ]));
+
+    // We can use the originalId field to see what each track is composed of.
+    expect(variants[0].audio.originalId)
+        .toBe('stream1,stream1,stream1,stream1');
+
+    expect(variants[1].audio.originalId)
+        .toBe('stream1,stream1,stream1,stream1');
+
+    expect(variants[2].audio.originalId)
+        .toBe('stream1,stream2,stream1,stream2');
+
+    expect(variants[3].audio.originalId)
+        .toBe('stream1,stream2,stream1,stream2');
+  });
 
   it('The number of variants stays stable after many periods ' +
       'when going between similar content and varying ads', async () => {
@@ -1148,7 +1285,7 @@ describe('PeriodCombiner', () => {
     // https://github.com/shaka-project/shaka-player/issues/2716
     // that used to cause our period flattening logic to keep
     // creating new variants for every new period added.
-    // It's ok to create a few additional varinats/streams,
+    // It's ok to create a few additional variants/streams,
     // but we should stabilize eventually and keep the number
     // of variants from growing indefinitely.
 
@@ -1334,7 +1471,7 @@ describe('PeriodCombiner', () => {
       expect(isCandidateBetter).toBe(WORSE);
 
       // Make sure it works correctly whether it's the candidate or the best
-      // value that is equel to the output.
+      // value that is equal to the output.
       isCandidateBetter = PeriodCombiner.compareClosestPreferLower(
           /* output= */ 5, /* bestValue= */ 3, /* candidateValue= */ 5);
       expect(isCandidateBetter).toBe(BETTER);
@@ -1461,11 +1598,12 @@ describe('PeriodCombiner', () => {
    * @param {number=} channels
    * @return {shaka.extern.Variant}
    */
-  function makeAVVariant(height, language, channels = 2) {
+  function makeAVVariant(height, language, channels = 2, roles = []) {
     const variant = jasmine.objectContaining({
       language,
       audio: jasmine.objectContaining({
         language,
+        roles,
         channelsCount: channels,
       }),
       video: jasmine.objectContaining({