138efd6007
fix(remux): validate stream URL scheme and restrict ffmpeg protocols (CWE-78)
...
The /api/remux endpoint passed the user-supplied 'url' query parameter
straight to 'ffmpeg -i <url>'. spawn() with an argv array prevented shell
injection, but ffmpeg itself accepts a wide set of protocol handlers
(file://, concat:, subfile:, data:, pipe:, crypto:, async:, cache:, ...)
that read from the local filesystem or compose existing protocols.
Because the resulting ffmpeg stdout is piped directly back to the
response, an attacker who could call /api/remux could read arbitrary
local files (e.g. ?url=file:///etc/passwd, concat:file://...).
Apply two layers of defence at the entry point only:
1. validateStreamUrl(): reject anything that is not a syntactically valid
http:// or https:// URL, and reject any string containing control
characters before parsing (so CR/LF/NUL cannot be silently stripped).
2. Pass -protocol_whitelist http,https,tls,tcp,hls to ffmpeg so that even
if a future code path forwarded a different URL, ffmpeg would refuse
to open file/concat/subfile/pipe/data/crypto/async/cache inputs.
Legitimate http/https stream URLs (including ports, userinfo, queries,
and HLS playlists) continue to work; only non-network schemes and
malformed inputs are rejected with HTTP 400.
2026-10-12 15:37:03 -07:00
98d2651e7b
Merge pull request #124 from asandhu3/ffmpeg-fixes
...
Fix ffmpeg redirects. Fix max resolution setting.
2026-10-12 15:16:31 -07:00
01349d48e7
fix(subtitle): validate url scheme and index to prevent local file reads
2026-07-22 22:15:09 +01:00
f5e2c77d25
Fix ffmpeg redirects. Fix max resolution setting.
2026-04-24 15:19:19 -06:00
50d337f87d
chore: update plugin readme
2026-02-05 01:46:10 -08:00
72e14dca57
feat: enhance plugin system with async support and lifecycle hooks & reverted PR #79 due to Node.js v24 stream compatibility issues
2026-02-05 01:42:40 -08:00
6eafa871b5
Merge pull request #82 from leo3438/main
...
feat: add modular plugin system and developer documentation
2026-02-04 15:46:10 -08:00
146f7dd1b1
feat: add modular plugin system and documentation
2026-02-04 10:48:36 +00:00
bfc80738f4
Refactor parseStreaming to use pendingBatches array
...
Was running into an issue where epg wouldn't process passed the first batch. Refactored the batching to use an array and added backpressure to keep memory usage low.
2026-01-31 19:31:03 -05:00
ac6c82e3fc
fix: resume from homepage not correctly handling source_id
2026-01-22 18:23:48 -08:00
3272b19177
fix: updated hardware scale filters to explicitly output 8-bit format (nv12), removed conflicting -pix_fmt flag
2026-01-19 15:13:39 -08:00
056555c7b4
fix: hardware transcoding 10-bit error and EPG navigation bug (Issues #61 , #63 )
2026-01-19 14:36:53 -08:00
059cfecdcc
feat: implement 4k upscaling
2026-01-19 01:45:44 -08:00
237d11cf00
feat: implement hardware and software upscaling
2026-01-19 01:34:45 -08:00
100a26fe4e
chore: update screenshots in readme and sso icon
2026-01-18 19:49:22 -08:00
f9fefa3947
fix: filter homepage recent sections by hidden status
2026-01-18 17:06:26 -08:00
b890d30253
feat: add home page with favorites, resume playback, recently added VOD
2026-01-18 14:04:40 -08:00
bf111e1fca
feat: add home page with resume functionality and recently added VOD
2026-01-18 03:08:08 -08:00
dc029f75e5
feat: implement per-user favorites with SQLite storage
2026-01-17 23:47:09 -08:00
d54428472c
feat: add user management modal with SSO/Local badges and fix OIDC session serialization
2026-01-17 23:36:34 -08:00
5752f529cb
feat: implement OIDC SSO with JIT provisioning
2026-01-17 22:52:06 -08:00
c4cc8ef63c
fix: added format=nv12 to scale_vaapi filter and -profile:v main to ensure encoder compatibility
2026-01-17 18:57:51 -08:00
8304e7abe1
build: simplified the dockerfile to install ffmpeg via apt
2026-01-17 18:38:15 -08:00
d85ed753ab
fix: resolve 'auto' encoder to detected hardware and add VAAPI drivers to Dockerfile
2026-01-17 17:54:50 -08:00
c1f8077438
feat: add smart audio copy and audio mix presets for configurable 5.1 downmixing
2026-01-17 13:31:13 -08:00
9919975663
Refine audio downmix to ITU standards
2026-01-17 03:31:33 -08:00
2c34359b2c
feat: Implement hardware-accelerated HLS transcoding with granular controls, smart stereo downmixing, and robust support for MKV and 10-bit HEVC playback.
2026-01-17 03:07:16 -08:00
efcf14a545
feat: implement GPU encoder pipelines
2026-01-17 01:39:26 -08:00
77eb7bff5f
feat: add dedicated transcoding settings tab
2026-01-17 01:27:27 -08:00
f0c1393ce0
feat: add hardware detection service for GPU-accelerated transcoding (NVIDIA/AMD/Intel/VAAPI)
2026-01-17 01:00:37 -08:00
2a03cad213
feat: add -seekable 0 to fix 405 errors and configurable User-Agent presets for stream requests
2026-01-17 00:45:55 -08:00
196b9520b7
feat: add large M3U playlist warning (50K+ channels)
2026-01-16 17:00:57 -08:00
aa0fb7b956
fix: m3u sync stale purge bug
2026-01-14 17:32:19 -08:00
60010cc734
fix: race condition where race condition where loadMovies/loadSeries was called before
...
hiddenCategoryIds was populated
2026-01-14 15:25:04 -08:00
0a013ec05f
fix: handle null stream names during Xtream sync ( #50 )
2026-01-14 14:48:31 -08:00
6834849cad
chore: updated readme nginx example
2026-01-12 16:50:12 -08:00
b81ce4856e
fix: store tvgId during M3U sync process for EPG matching ( #44 )
2026-01-12 14:26:54 -08:00
c951a5998e
fix: normalize epg_channel_id for M3U sources ( #44 )
2026-01-12 14:01:37 -08:00
838b540922
chore: remove deprecated M3U proxy route and API method
2026-01-12 00:23:27 -08:00
a86f9ca878
feat: add M3uXtreamAdapter service for unified API handling
2026-01-11 23:52:45 -08:00
098dc3a8ce
feat: add version badge to header displaying app version from package.json
2026-01-11 23:31:34 -08:00
aeee45869b
Fixed EPG description not displaying due to property name mismatch
2026-01-10 14:10:07 -08:00
8d36a2c07e
feat: add subtitle extraction and display for MKV/container streams
2026-01-10 12:35:39 -08:00
346a0519e9
feat: added smart auto-transcoding with probe-based routing and MKV/remux support
2026-01-10 00:35:42 -08:00
e8e6ba27d7
Implemented streaming parsers for M3U and EPG to reduce memory usage
2026-01-07 23:09:23 -08:00
67d9cb26d2
Fix proxy streaming for small files like HLS encryption keys
2026-01-07 16:38:17 -08:00
ffd995c1c5
Fix Pluto TV key loading by expanding CDN domain detection
2026-01-07 14:32:40 -08:00
7184a1ba56
Added DEFAULT_MAX_AGE_HOURS constant to proxy route
2026-01-07 13:51:05 -08:00
3e834d4f41
Fix: Restore proper HLS stream proxy with encryption key handling
2026-01-07 11:17:01 -05:00
5bb0629de2
Changed transcode ffmpeg flags
2026-01-06 20:16:20 -08:00
