Merge remote-tracking branch 'origin/inline-m3u-player' into next

hyphanet · Mar 13, 2021 · 1785628 · 1785628
2 parents 894c084 + b0fc0c7
commit 1785628
Show file tree

Hide file tree

Showing 6 changed files with 363 additions and 34 deletions.
diff --git a/src/freenet/client/filter/HTMLFilter.java b/src/freenet/client/filter/HTMLFilter.java
@@ -43,6 +43,9 @@
 
 public class HTMLFilter implements ContentDataFilter, CharsetExtractor {
 
+	private static final String M3U_PLAYER_TAG_FILE = "freenet/clients/http/staticfiles/js/m3u-player.js";
+	/** if true, embed m3u player. Enabled when fproxy javascript is enabled. **/
+	public static boolean embedM3uPlayer = true;
 	private static boolean logMINOR;
 	private static boolean logDEBUG;
 
@@ -61,6 +64,8 @@ public class HTMLFilter implements ContentDataFilter, CharsetExtractor {
 	/** -1 means don't allow it */
 	public static int metaRefreshRedirectMinInterval = 30;
 
+	private static final String m3uPlayerScriptTagContent = m3uPlayerScriptTagContent();
+
 	@Override
 	public void readFilter(
       InputStream input, OutputStream output, String charset, Map<String, String> otherParams,
@@ -559,6 +564,30 @@ else if((c < 32) && (c != '\t') && (c != '\n') && (c != '\r')) {
 		w.write(sout);
 	}
 
+	static String m3uPlayerScriptTagContent() {
+		InputStream m3uPlayerTagStream = HTMLFilter.class.getClassLoader()
+				.getResourceAsStream(M3U_PLAYER_TAG_FILE);
+		String errorTag = "/* Error: could not load " + M3U_PLAYER_TAG_FILE + " */";
+		if (m3uPlayerTagStream == null) {
+			return errorTag;
+		}
+		String tagContent;
+		try (BufferedReader bufferedReader = new BufferedReader(new InputStreamReader(m3uPlayerTagStream))) {
+			StringBuilder stringBuilder = new StringBuilder("<script>");
+			String line;
+			while ((line = bufferedReader.readLine()) != null) {
+				stringBuilder.append(line);
+				stringBuilder.append("\n");
+			}
+			stringBuilder.append("</script>");
+			tagContent = stringBuilder.toString();
+		} catch (IOException e) {
+			Logger.error(HTMLFilter.class, "Could not read m3uPlayer inline-script.");
+			return errorTag;
+		}
+		return tagContent;
+	}
+
 	String processTag(List<String> splitTag, Writer w, HTMLParseContext pc)
 		throws IOException, DataFilterException {
 		// First, check that it is a recognized tag
@@ -578,6 +607,9 @@ String processTag(List<String> splitTag, Writer w, HTMLParseContext pc)
 				if(t.element.compareTo("head")==0 && !t.startSlash){
 					pc.wasHeadElementFound=true;
 				} else if(t.element.compareTo("head")==0 && t.startSlash) {
+					if (embedM3uPlayer) {
+						w.write(m3uPlayerScriptTagContent);
+					}
 					pc.headEnded = true;
 					if(pc.onlyDetectingCharset) pc.failedDetectCharset = true;
 				//If we found a <title> or a <meta> without a <head>, then we need to add them to a <head>
@@ -592,7 +624,12 @@ String processTag(List<String> splitTag, Writer w, HTMLParseContext pc)
 					throwFilterException(l10n("metaOutsideHead"));
 				//If we found a <body> and haven't closed <head> already, then we do
 				}else if(t.element.compareTo("body") == 0 &&  pc.openElements.contains("head")){
-					if(!pc.onlyDetectingCharset) w.write("</head>");
+					if(!pc.onlyDetectingCharset) {
+						if (embedM3uPlayer) {
+							w.write(m3uPlayerScriptTagContent);
+						}
+						w.write("</head>");
+					}
 					pc.headEnded = true;
 					if(pc.onlyDetectingCharset) pc.failedDetectCharset = true;
 					pc.openElements.pop();
@@ -601,7 +638,12 @@ String processTag(List<String> splitTag, Writer w, HTMLParseContext pc)
 					pc.wasHeadElementFound=true;
 					String headContent=pc.cb.processTag(new ParsedTag("head", new HashMap<String, String>()));
 					if(headContent!=null){
-						if(!pc.onlyDetectingCharset) w.write(headContent+"</head>");
+						if(!pc.onlyDetectingCharset) {
+							if (embedM3uPlayer) {
+								w.write(m3uPlayerScriptTagContent);
+							}
+							w.write(headContent+"</head>");
+						}
 						pc.headEnded = true;
 						if(pc.onlyDetectingCharset) pc.failedDetectCharset = true;
 					}

diff --git a/src/freenet/clients/http/SimpleToadletServer.java b/src/freenet/clients/http/SimpleToadletServer.java
@@ -758,6 +758,21 @@ public void set(Integer val)
 		}, false);
 		HTMLFilter.metaRefreshRedirectMinInterval = Math.max(-1, fproxyConfig.getInt("metaRefreshRedirectInterval"));
 
+		fproxyConfig.register("embedM3uPlayerInFreesites", true, configItemOrder++, true, false, "SimpleToadletServer.embedM3uPlayerInFreesites", "SimpleToadletServer.embedM3uPlayerInFreesitesLong",
+				new BooleanCallback() {
+
+					@Override
+					public Boolean get() {
+						return HTMLFilter.embedM3uPlayer;
+					}
+
+					@Override
+					public void set(Boolean val) {
+						HTMLFilter.embedM3uPlayer = val;
+					}
+				});
+		HTMLFilter.embedM3uPlayer = fproxyConfig.getBoolean("embedM3uPlayerInFreesites");
+
 		fproxyConfig.register("refilterPolicy", "RE_FILTER",
 				configItemOrder++, true, false, "SimpleToadletServer.refilterPolicy", "SimpleToadletServer.refilterPolicyLong", new ReFilterCallback());
 

diff --git a/src/freenet/clients/http/ToadletContextImpl.java b/src/freenet/clients/http/ToadletContextImpl.java
@@ -18,7 +18,9 @@
 import java.util.ArrayList;
 import java.util.Date;
 import java.util.Enumeration;
+import java.util.List;
 import java.util.Locale;
+import java.util.StringJoiner;
 import java.util.TimeZone;
 
 import freenet.clients.http.FProxyFetchInProgress.REFILTER_POLICY;
@@ -445,9 +447,12 @@ static void sendReplyHeaders(OutputStream sockOutputStream, int replyCode, Strin
 
 	private static String generateCSP(boolean allowScripts, boolean allowFrames) {
 	    StringBuilder sb = new StringBuilder();
-	    sb.append("default-src 'self'; script-src ");
+	    // allow access to blobs, because these are purely local
+	    sb.append("default-src 'self' blob:; script-src ");
 	    // "options inline-script" is old syntax needed for older Firefox's.
-	    sb.append(allowScripts ? "'self' 'unsafe-inline'; options inline-script" : "'none'");
+	    sb.append(allowScripts
+					? "'self' 'unsafe-inline'; options inline-script"
+					: generateRestrictedScriptSrc());
 	    sb.append("; frame-src ");
         sb.append(allowFrames ? "'self'" : "'none'");
         sb.append("; object-src 'none'");
@@ -457,8 +462,24 @@ private static String generateCSP(boolean allowScripts, boolean allowFrames) {
         return sb.toString();
     }
 
-    static TimeZone TZ_UTC = TimeZone.getTimeZone("UTC");
-
+	private static String generateRestrictedScriptSrc() {
+		// TODO: auto-generate these hashes from the path to the source file
+		String[] allowedScriptHashes = new String[] {
+				"sha256-emGXuxNdTQP2ylJOeGhLCKYFO+1g/2u6FtPSzMKQ06A=" // freenet/clients/http/staticfiles/js/m3u-player.js
+		};
+		if (allowedScriptHashes.length == 0) {
+			return "'none'";
+		} else {
+			StringJoiner stringJoiner = new StringJoiner("' '", "'", "'");
+			for (String source : allowedScriptHashes) {
+				stringJoiner.add(source);
+			}
+			return stringJoiner.toString();
+		}
+	}
+
+	static TimeZone TZ_UTC = TimeZone.getTimeZone("UTC");
+
 	public static Date parseHTTPDate(String httpDate) throws java.text.ParseException{
 		SimpleDateFormat sdf = new SimpleDateFormat("EEE, dd MMM yyyy HH:mm:ss 'GMT'",Locale.US);
 		sdf.setTimeZone(TZ_UTC);