Files
vibesonic/internal/subsonic/podcasts.go
T
owenandClaude Sonnet 5 789bf91eed Complete Phase 4: security hardening, player/playlist/admin UI, docs
Security:
- New internal/netguard package: podcast feed/enclosure fetching now
  refuses to dial non-public IPs (loopback/RFC1918/link-local/cloud
  metadata/CGNAT), validated per-connection including across redirects,
  closing an SSRF gap where a malicious or compromised feed URL could
  probe the server's internal network. Configurable via
  VIBESONIC_PODCASTS_ALLOW_PRIVATE_NETWORKS for intentional LAN feeds.
- Podcast episode downloads capped at 4GB (was unbounded, disk-exhaustion risk)
- Cover art decoding now rejects images above a 40-megapixel budget
  before full decode (decompression-bomb guard)
- HTTP server sets ReadHeaderTimeout (slowloris hardening)
- Admin folder-scan redirect now validated as same-site instead of
  trusting the raw Referer header (open-redirect fix)
- Legacy Subsonic token/salt auth now uses a constant-time comparison

Web UI completion:
- Persistent player: shuffle and repeat (off/all/one) controls, wired
  into queue advance/prev logic and persisted like other player state
- Admin user-permissions form: adminRole toggle (with a guard against
  demoting the last remaining admin) and per-user music-folder access
  checkboxes, backed by existing schema/enforcement that was previously
  unreachable from the UI
- Playlist M3U8 import/export

Docs: added docs/client-compatibility.md (honest tracking template —
no client testing has been performed), docs/deployment.md,
docs/security.md, docs/backup.md; refreshed README and cross-links;
added a footnote in docs/subsonic-compatibility.md distinguishing
spec-standard from VibeSonic-original OpenSubsonic extensions.

Also added Go fuzz tests for the external-auth CIDR/IP parser and the
LRC lyrics parser.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014r98AtcBbevpscWLsfwVvv
2026-08-23 09:18:17 -05:00

249 lines
6.7 KiB
Go

package subsonic
import (
"context"
"database/sql"
"git.noroutes.net/NoRoutes/vibetunes/internal/database"
"git.noroutes.net/NoRoutes/vibetunes/internal/netguard"
)
func init() {
registerExtension("getPodcastEpisode", 1)
register("getPodcastEpisode", handleGetPodcastEpisode)
register("getPodcasts", handleGetPodcasts)
register("getNewestPodcasts", handleGetNewestPodcasts)
register("refreshPodcasts", handleRefreshPodcasts)
register("createPodcastChannel", handleCreatePodcastChannel)
register("deletePodcastChannel", handleDeletePodcastChannel)
register("deletePodcastEpisode", handleDeletePodcastEpisode)
register("downloadPodcastEpisode", handleDownloadPodcastEpisode)
}
func podcastEpisodeToModel(db *sql.DB, e *database.PodcastEpisode, userID string) PodcastEpisode {
pe := PodcastEpisode{
Child: Child{
ID: e.ID,
Title: e.Title,
Album: e.Title,
Genre: "Podcast",
Type: "podcast",
Created: isoTime(e.CreatedAt),
},
ChannelID: e.ChannelID,
Description: e.Description,
Status: e.Status,
PublishDate: e.PublishDate,
}
if e.MediaFileID.Valid {
if mf, err := database.GetMediaFile(db, e.MediaFileID.String); err == nil {
pe.Child.Duration = int(mf.DurationSeconds + 0.5)
pe.Child.Size = mf.SizeBytes
pe.Child.Suffix = suffixForFormat(mf.Format)
pe.Child.ContentType = contentTypeForFormat(mf.Format)
// Once downloaded, an episode streams as an ordinary song
// (same /rest/stream path, permission checks, everything).
if song, serr := database.GetSongByMediaFileID(db, mf.ID); serr == nil {
pe.Child.ID = song.ID
pe.StreamID = song.ID
}
}
} else {
pe.Child.Duration = int(e.DurationSeconds + 0.5)
}
return pe
}
func podcastChannelToModel(db *sql.DB, c *database.PodcastChannel, withEpisodes bool, userID string) (PodcastChannel, error) {
pc := PodcastChannel{
ID: c.ID,
URL: c.URL,
Title: c.Title,
Description: c.Description,
Status: c.Status,
ErrorMessage: c.ErrorMessage,
}
if c.CoverArtID.Valid {
pc.CoverArt = c.CoverArtID.String
}
if withEpisodes {
episodes, err := database.ListPodcastEpisodes(db, c.ID)
if err != nil {
return pc, err
}
for _, e := range episodes {
pc.Episode = append(pc.Episode, podcastEpisodeToModel(db, e, userID))
}
}
return pc, nil
}
func handleGetPodcastEpisode(rc *Context) *apiError {
if !rc.User.Allows(rc.User.Permissions.Podcast) {
return errUnauthorized("podcasts")
}
id, aerr := rc.Params.Required("id")
if aerr != nil {
return aerr
}
ep, err := database.GetPodcastEpisode(rc.Server.DB, id)
if err != nil {
return errNotFound("Podcast episode")
}
model := podcastEpisodeToModel(rc.Server.DB, ep, rc.User.ID)
rc.Response = newResponse()
rc.Response.PodcastEpisode = &model
return nil
}
func handleGetPodcasts(rc *Context) *apiError {
if !rc.User.Allows(rc.User.Permissions.Podcast) {
return errUnauthorized("podcasts")
}
db := rc.Server.DB
withEpisodes := rc.Params.Bool("includeEpisodes", true)
out := &Podcasts{}
if id := rc.Params.Get("id"); id != "" {
channel, err := database.GetPodcastChannel(db, id)
if err != nil {
return errNotFound("Podcast channel")
}
model, merr := podcastChannelToModel(db, channel, withEpisodes, rc.User.ID)
if merr != nil {
return newError(ErrGeneric, merr.Error())
}
out.Channel = append(out.Channel, model)
} else {
channels, err := database.ListPodcastChannels(db)
if err != nil {
return newError(ErrGeneric, err.Error())
}
for _, c := range channels {
model, merr := podcastChannelToModel(db, c, withEpisodes, rc.User.ID)
if merr != nil {
continue
}
out.Channel = append(out.Channel, model)
}
}
rc.Response = newResponse()
rc.Response.Podcasts = out
return nil
}
func handleGetNewestPodcasts(rc *Context) *apiError {
if !rc.User.Allows(rc.User.Permissions.Podcast) {
return errUnauthorized("podcasts")
}
count := rc.Params.Int("count", 20)
episodes, err := database.ListNewestPodcastEpisodes(rc.Server.DB, count)
if err != nil {
return newError(ErrGeneric, err.Error())
}
out := &NewestPodcasts{}
for _, e := range episodes {
out.Episode = append(out.Episode, podcastEpisodeToModel(rc.Server.DB, e, rc.User.ID))
}
rc.Response = newResponse()
rc.Response.NewestPodcasts = out
return nil
}
func handleRefreshPodcasts(rc *Context) *apiError {
if !rc.User.IsAdmin {
return errUnauthorized("refreshing podcasts")
}
channels, err := database.ListPodcastChannels(rc.Server.DB)
if err != nil {
return newError(ErrGeneric, err.Error())
}
for _, c := range channels {
id := c.ID
go func() {
_ = rc.Server.Podcasts.RefreshChannel(context.Background(), id)
}()
}
rc.Response = newResponse()
return nil
}
func handleCreatePodcastChannel(rc *Context) *apiError {
if !rc.User.IsAdmin {
return errUnauthorized("managing podcasts")
}
feedURL, aerr := rc.Params.Required("url")
if aerr != nil {
return aerr
}
if err := netguard.ValidateURL(feedURL); err != nil {
return newError(ErrGeneric, err.Error())
}
channel, err := database.CreatePodcastChannel(rc.Server.DB, feedURL)
if err != nil {
return newError(ErrGeneric, err.Error())
}
go func() {
_ = rc.Server.Podcasts.RefreshChannel(context.Background(), channel.ID)
}()
rc.Response = newResponse()
return nil
}
func handleDeletePodcastChannel(rc *Context) *apiError {
if !rc.User.IsAdmin {
return errUnauthorized("managing podcasts")
}
id, aerr := rc.Params.Required("id")
if aerr != nil {
return aerr
}
if _, err := database.GetPodcastChannel(rc.Server.DB, id); err != nil {
return errNotFound("Podcast channel")
}
if err := database.DeletePodcastChannel(rc.Server.DB, id); err != nil {
return newError(ErrGeneric, err.Error())
}
rc.Response = newResponse()
return nil
}
func handleDeletePodcastEpisode(rc *Context) *apiError {
if !rc.User.IsAdmin {
return errUnauthorized("managing podcasts")
}
id, aerr := rc.Params.Required("id")
if aerr != nil {
return aerr
}
if _, err := database.GetPodcastEpisode(rc.Server.DB, id); err != nil {
return errNotFound("Podcast episode")
}
if err := database.DeletePodcastEpisode(rc.Server.DB, id); err != nil {
return newError(ErrGeneric, err.Error())
}
rc.Response = newResponse()
return nil
}
func handleDownloadPodcastEpisode(rc *Context) *apiError {
if !rc.User.IsAdmin {
return errUnauthorized("managing podcasts")
}
id, aerr := rc.Params.Required("id")
if aerr != nil {
return aerr
}
if _, err := database.GetPodcastEpisode(rc.Server.DB, id); err != nil {
return errNotFound("Podcast episode")
}
go func() {
if err := rc.Server.Podcasts.DownloadEpisode(context.Background(), id); err != nil {
rc.Server.Log.Warn("podcast episode download failed", "episode", id, "err", err)
}
}()
rc.Response = newResponse()
return nil
}