Skip to content
89 changes: 86 additions & 3 deletions extensions/Lily/Video.js
Copy link
Author

@jexjws jexjws Dec 11, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if (!(await Scratch.canFetch(url))) return;

WARNING : If the resource URLs in a .m3u8 file are not on the same domain as the .m3u8 file itself, the client can fetch resources from other domains without using Scratch.fetch.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Perhaps you can do a check using a custom loader for hls.js before a playlist or fragment gets loaded. This is a quick mock up but haven't tested it at all:

this.hls = new Hls({
  loader: class CustomLoader extends Hls.DefaultConfig.loader {
    load(context, config, callbacks) {
      let { type, url } = context;

      // Custom behavior - do a check first
      Scratch.canFetch(url).then(isAllowed => {
        if (!isAllowed) {
          callbacks.onErrorCallback({
            code: 'Scratch_Error',
            text: `${err}`
          });
        } else {
          super.load(context, config, callbacks);
        }
      }).catch(err => callbacks.onErrorCallback({
        code: 'Scratch_Error',
        text: `${err}`
      }));
    }
  }
});

Large diffs are not rendered by default.

Loading