Add nonce to pubsub token

src/invidious.cr

@@ -2329,13 +2329,19 @@ get "/feed/webhook/:token" do |env|
   challenge = env.params.query["hub.challenge"]
   lease_seconds = env.params.query["hub.lease_seconds"]
 
+  if verify_token.starts_with? "v1"
+    _, time, nonce, signature = verify_token.split(":")
+    data = "#{time}:#{nonce}"
+  else
     time, signature = verify_token.split(":")
+    data = "#{time}"
+  end
 
   if Time.now.to_unix - time.to_i > 600
     halt env, status_code: 400
   end
 
-  if OpenSSL::HMAC.hexdigest(:sha1, HMAC_KEY, time) != signature
+  if OpenSSL::HMAC.hexdigest(:sha1, HMAC_KEY, data) != signature
     halt env, status_code: 400
   end
 

src/invidious/channels.cr

@@ -194,11 +194,13 @@ end
 def subscribe_pubsub(ucid, key, config)
   client = make_client(PUBSUB_URL)
   time = Time.now.to_unix.to_s
+  nonce = Random::Secure.hex(4)
+  signature = "#{time}:#{nonce}"
 
   host_url = make_host_url(Kemal.config.ssl || config.https_only, config.domain)
 
   body = {
-    "hub.callback"      => "#{host_url}/feed/webhook/#{time}:#{OpenSSL::HMAC.hexdigest(:sha1, key, time)}",
+    "hub.callback"      => "#{host_url}/feed/webhook/v1:#{time}:#{nonce}:#{OpenSSL::HMAC.hexdigest(:sha1, key, signature)}",
     "hub.topic"         => "https://www.youtube.com/feeds/videos.xml?channel_id=#{ucid}",
     "hub.verify"        => "async",
     "hub.mode"          => "subscribe",