shaka-player 4.1.4 → 4.1.6

package/lib/util/player_configuration.js

@@ -75,6 +75,10 @@ shaka.util.PlayerConfiguration = class {
       updateExpirationTime: 1,
       preferredKeySystems: [],
       keySystemsMapping: {},
+      // The Xbox One browser does not detect DRM key changes signalled by a
+      // change in the PSSH in media segments. We need to parse PSSH from media
+      // segments to detect key changes.
+      parseInbandPsshEnabled: shaka.util.Platform.isXboxOne(),
     };
 
     const manifest = {

package/lib/util/pssh.js

@@ -42,11 +42,12 @@ shaka.util.Pssh = class {
 
     new shaka.util.Mp4Parser()
         .box('moov', shaka.util.Mp4Parser.children)
+        .box('moof', shaka.util.Mp4Parser.children)
         .fullBox('pssh', (box) => this.parsePsshBox_(box))
         .parse(psshBox);
 
     if (this.data.length == 0) {
-      shaka.log.warning('No pssh box found!');
+      shaka.log.v2('No pssh box found!');
     }
   }
 

package/lib/util/stream_utils.js

@@ -474,7 +474,8 @@ shaka.util.StreamUtils = class {
       if (shaka.util.Platform.isXboxOne() && video &&
           ((video.width && video.width > 1920) ||
           (video.height && video.height > 1080)) &&
-          video.codecs.includes('avc1.')) {
+          (video.codecs.includes('avc1.') ||
+          video.codecs.includes('avc3.'))) {
         shaka.log.debug('Dropping variant - not compatible with platform',
             shaka.util.StreamUtils.getVariantSummaryString_(variant));
         return false;

package/lib/util/xml_utils.js

@@ -8,6 +8,7 @@ goog.provide('shaka.util.XmlUtils');
 
 goog.require('goog.asserts');
 goog.require('shaka.log');
+goog.require('shaka.util.Lazy');
 goog.require('shaka.util.StringUtils');
 
 
@@ -348,19 +349,21 @@ shaka.util.XmlUtils = class {
    */
   static parseXmlString(xmlString, expectedRootElemName) {
     const parser = new DOMParser();
-    let xml = null;
+    const unsafeXmlString =
+        shaka.util.XmlUtils.trustedHTMLFromString_.value()(xmlString);
+    let unsafeXml = null;
     try {
-      xml = parser.parseFromString(xmlString, 'text/xml');
+      unsafeXml = parser.parseFromString(unsafeXmlString, 'text/xml');
     } catch (exception) {
       shaka.log.error('XML parsing exception:', exception);
       return null;
     }
 
     // According to MDN, parseFromString never returns null.
-    goog.asserts.assert(xml, 'Parsed XML document cannot be null!');
+    goog.asserts.assert(unsafeXml, 'Parsed XML document cannot be null!');
 
     // Check for empty documents.
-    const rootElem = xml.documentElement;
+    const rootElem = unsafeXml.documentElement;
     if (!rootElem) {
       shaka.log.error('XML document was empty!');
       return null;
@@ -374,13 +377,28 @@ shaka.util.XmlUtils = class {
     }
 
     // The top-level element in the loaded XML should have the name we expect.
-    if (xml.documentElement.tagName != expectedRootElemName) {
+    if (rootElem.tagName != expectedRootElemName) {
       shaka.log.error(
           `XML tag name does not match expected "${expectedRootElemName}":`,
-          xml.documentElement.tagName);
+          rootElem.tagName);
       return null;
     }
 
+    // SECURITY: Verify that the document does not contain elements from the
+    // HTML or SVG namespaces, which could trigger script execution and XSS.
+    const iterator = document.createNodeIterator(
+        unsafeXml,
+        NodeFilter.SHOW_ALL,
+    );
+    let currentNode;
+    while (currentNode = iterator.nextNode()) {
+      if (currentNode instanceof HTMLElement ||
+          currentNode instanceof SVGElement) {
+        shaka.log.error('XML document embeds unsafe content!');
+        return null;
+      }
+    }
+
     return rootElem;
   }
 
@@ -402,3 +420,24 @@ shaka.util.XmlUtils = class {
     }
   }
 };
+
+/**
+ * Promote a string to TrustedHTML. This function is security-sensitive and
+ * should only be used with security approval where the string is guaranteed not
+ * to cause an XSS vulnerability.
+ *
+ * @private {!shaka.util.Lazy.<function(!string): (!TrustedHTML|!string)>}
+ */
+shaka.util.XmlUtils.trustedHTMLFromString_ = new shaka.util.Lazy(() => {
+  if (typeof trustedTypes !== 'undefined') {
+    // Create a Trusted Types policy for promoting the string to TrustedHTML.
+    // The Lazy wrapper ensures this policy is only created once.
+    const policy = trustedTypes.createPolicy('shaka-player#xml', {
+      createHTML: (s) => s,
+    });
+    return (s) => policy.createHTML(s);
+  }
+  // Fall back to strings in environments that don't support Trusted Types.
+  return (s) => s;
+});
+

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "shaka-player",
   "description": "DASH/EME video player library",
-  "version": "4.1.4",
+  "version": "4.1.6",
   "homepage": "https://github.com/shaka-project/shaka-player",
   "author": "Google",
   "maintainers": [

package/test/cea/cea608_memory_unit.js

@@ -295,5 +295,93 @@ describe('Cea608Memory', () => {
       const caption = memory.forceEmit(startTime, endTime);
       expect(caption).toEqual(expectedCaption);
     });
+
+    it('does not move rows if source row index is negative', () => {
+      const startTime = 1;
+      const endTime = 2;
+      const text = 'test';
+
+      // Add the text to the buffer, each character on separate rows.
+      // At this point, the memory looks like:
+      // [1]: t
+      // [2]: e
+      // [3]: s
+      // [4]: t
+      for (const c of text) {
+        memory.addChar(CharSet.BASIC_NORTH_AMERICAN,
+            c.charCodeAt(0));
+        memory.setRow(memory.getRow() + 1); // increment row
+      }
+
+      const srcRowIdx = -1;
+      const dstRowIdx = 2;
+      const rowsToMove = 3;
+      memory.moveRows(dstRowIdx, srcRowIdx, rowsToMove);
+
+      // Expected text is 't\ne\ns\nt'
+      const topLevelCue = new shaka.text.Cue(startTime, endTime, '');
+      topLevelCue.nestedCues = [
+        CeaUtils.createDefaultCue(startTime, endTime, 't'),
+        CeaUtils.createLineBreakCue(startTime, endTime),
+        CeaUtils.createDefaultCue(startTime, endTime, 'e'),
+        CeaUtils.createLineBreakCue(startTime, endTime),
+        CeaUtils.createDefaultCue(startTime, endTime, 's'),
+        CeaUtils.createLineBreakCue(startTime, endTime),
+        CeaUtils.createDefaultCue(startTime, endTime, 't'),
+      ];
+
+      const expectedCaption = {
+        stream,
+        cue: topLevelCue,
+      };
+
+      // Force out the new memory.
+      const caption = memory.forceEmit(startTime, endTime);
+      expect(caption).toEqual(expectedCaption);
+    });
+
+    it('does not move rows if destination row index is negative', () => {
+      const startTime = 1;
+      const endTime = 2;
+      const text = 'test';
+
+      // Add the text to the buffer, each character on separate rows.
+      // At this point, the memory looks like:
+      // [1]: t
+      // [2]: e
+      // [3]: s
+      // [4]: t
+      for (const c of text) {
+        memory.addChar(CharSet.BASIC_NORTH_AMERICAN,
+            c.charCodeAt(0));
+        memory.setRow(memory.getRow() + 1); // increment row
+      }
+
+      const srcRowIdx = 1;
+      const dstRowIdx = -2;
+      const rowsToMove = 3;
+      memory.moveRows(dstRowIdx, srcRowIdx, rowsToMove);
+
+      // Expected text is 't\ne\ns\nt'
+      const topLevelCue = new shaka.text.Cue(startTime, endTime, '');
+      topLevelCue.nestedCues = [
+        CeaUtils.createDefaultCue(startTime, endTime, 't'),
+        CeaUtils.createLineBreakCue(startTime, endTime),
+        CeaUtils.createDefaultCue(startTime, endTime, 'e'),
+        CeaUtils.createLineBreakCue(startTime, endTime),
+        CeaUtils.createDefaultCue(startTime, endTime, 's'),
+        CeaUtils.createLineBreakCue(startTime, endTime),
+        CeaUtils.createDefaultCue(startTime, endTime, 't'),
+      ];
+
+      const expectedCaption = {
+        stream,
+        cue: topLevelCue,
+      };
+
+      // Force out the new memory.
+      const caption = memory.forceEmit(startTime, endTime);
+      expect(caption).toEqual(expectedCaption);
+    });
   });
 });

package/test/dash/dash_parser_content_protection_unit.js

@@ -43,6 +43,7 @@ describe('DashParser ContentProtection', () => {
       isLowLatencyMode: () => false,
       isAutoLowLatencyMode: () => false,
       enableLowLatencyMode: () => {},
+      updateDuration: () => {},
     };
 
     const actual = await dashParser.start(

package/test/dash/dash_parser_live_unit.js

@@ -36,6 +36,7 @@ describe('DashParser Live', () => {
       isLowLatencyMode: () => false,
       isAutoLowLatencyMode: () => false,
       enableLowLatencyMode: () => {},
+      updateDuration: () => {},
     };
   });
 

package/test/dash/dash_parser_manifest_unit.js

@@ -52,6 +52,7 @@ describe('DashParser Manifest', () => {
       isLowLatencyMode: () => false,
       isAutoLowLatencyMode: () => false,
       enableLowLatencyMode: () => {},
+      updateDuration: () => {},
     };
   });
 

package/test/dash/dash_parser_segment_base_unit.js

@@ -38,6 +38,7 @@ describe('DashParser SegmentBase', () => {
       isLowLatencyMode: () => false,
       isAutoLowLatencyMode: () => false,
       enableLowLatencyMode: () => {},
+      updateDuration: () => {},
     };
   });
 

package/test/dash/dash_parser_segment_list_unit.js

@@ -348,6 +348,7 @@ describe('DashParser SegmentList', () => {
       isLowLatencyMode: () => false,
       isAutoLowLatencyMode: () => false,
       enableLowLatencyMode: () => {},
+      updateDuration: () => {},
     };
     const manifest = await dashParser.start('dummy://foo', playerInterface);
     const stream = manifest.variants[0].video;

package/test/dash/dash_parser_segment_template_unit.js

@@ -47,6 +47,7 @@ describe('DashParser SegmentTemplate', () => {
       isLowLatencyMode: () => false,
       isAutoLowLatencyMode: () => false,
       enableLowLatencyMode: () => {},
+      updateDuration: () => {},
     };
   });