lug/invidious
7
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add nonce to pubsub token

Browse Source
This commit is contained in:
Omar Roth 2019-03-04 07:53:31 -06:00
parent 5895604282
commit 004fb96b2f
2 changed files with 13 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/invidious.cr
View File

@ -2329,13 +2329,19 @@ get "/feed/webhook/:token" do |env|
challenge = env.params.query["hub.challenge"]
lease_seconds = env.params.query["hub.lease_seconds"]
if verify_token.starts_with? "v1"
_, time, nonce, signature = verify_token.split(":")
data = "#{time}:#{nonce}"
else
time, signature = verify_token.split(":")
data = "#{time}"
end
if Time.now.to_unix - time.to_i > 600
halt env, status_code: 400
end
if OpenSSL::HMAC.hexdigest(:sha1, HMAC_KEY, time) != signature
if OpenSSL::HMAC.hexdigest(:sha1, HMAC_KEY, data) != signature
halt env, status_code: 400
end

4
src/invidious/channels.cr
View File

@ -194,11 +194,13 @@ end
def subscribe_pubsub(ucid, key, config)
client = make_client(PUBSUB_URL)
time = Time.now.to_unix.to_s
nonce = Random::Secure.hex(4)
signature = "#{time}:#{nonce}"
host_url = make_host_url(Kemal.config.ssl || config.https_only, config.domain)
body = {
"hub.callback" => "#{host_url}/feed/webhook/#{time}:#{OpenSSL::HMAC.hexdigest(:sha1, key, time)}",
"hub.callback" => "#{host_url}/feed/webhook/v1:#{time}:#{nonce}:#{OpenSSL::HMAC.hexdigest(:sha1, key, signature)}",
"hub.topic" => "https://www.youtube.com/feeds/videos.xml?channel_id=#{ucid}",
"hub.verify" => "async",
"hub.mode" => "subscribe",