server/middlewares/validators/oembed.ts

   1 import express from 'express'
   2 import { query } from 'express-validator'
   3 import { join } from 'path'
   4 import { loadVideo } from '@server/lib/model-loaders'
   5 import { VideoPlaylistModel } from '@server/models/video/video-playlist'
   6 import { VideoPlaylistPrivacy, VideoPrivacy } from '@shared/models'
   7 import { HttpStatusCode } from '../../../shared/models/http/http-error-codes'
   8 import { isTestOrDevInstance } from '../../helpers/core-utils'
   9 import { isIdOrUUIDValid, isUUIDValid, toCompleteUUID } from '../../helpers/custom-validators/misc'
  10 import { logger } from '../../helpers/logger'
  11 import { WEBSERVER } from '../../initializers/constants'
  12 import { areValidationErrors } from './shared'
  13
  14 const playlistPaths = [
  15   join('videos', 'watch', 'playlist'),
  16   join('w', 'p')
  17 ]
  18
  19 const videoPaths = [
  20   join('videos', 'watch'),
  21   'w'
  22 ]
  23
  24 function buildUrls (paths: string[]) {
  25   return paths.map(p => WEBSERVER.SCHEME + '://' + join(WEBSERVER.HOST, p) + '/')
  26 }
  27
  28 const startPlaylistURLs = buildUrls(playlistPaths)
  29 const startVideoURLs = buildUrls(videoPaths)
  30
  31 const isURLOptions = {
  32   require_host: true,
  33   require_tld: true
  34 }
  35
  36 // We validate 'localhost', so we don't have the top level domain
  37 if (isTestOrDevInstance()) {
  38   isURLOptions.require_tld = false
  39 }
  40
  41 const oembedValidator = [
  42   query('url')
  43     .isURL(isURLOptions),
  44   query('maxwidth')
  45     .optional()
  46     .isInt(),
  47   query('maxheight')
  48     .optional()
  49     .isInt(),
  50   query('format')
  51     .optional()
  52     .isIn([ 'xml', 'json' ]),
  53
  54   async (req: express.Request, res: express.Response, next: express.NextFunction) => {
  55     logger.debug('Checking oembed parameters', { parameters: req.query })
  56
  57     if (areValidationErrors(req, res)) return
  58
  59     if (req.query.format !== undefined && req.query.format !== 'json') {
  60       return res.fail({
  61         status: HttpStatusCode.NOT_IMPLEMENTED_501,
  62         message: 'Requested format is not implemented on server.',
  63         data: {
  64           format: req.query.format
  65         }
  66       })
  67     }
  68
  69     const url = req.query.url as string
  70
  71     let urlPath: string
  72
  73     try {
  74       urlPath = new URL(url).pathname
  75     } catch (err) {
  76       return res.fail({
  77         status: HttpStatusCode.BAD_REQUEST_400,
  78         message: err.message,
  79         data: {
  80           url
  81         }
  82       })
  83     }
  84
  85     const isPlaylist = startPlaylistURLs.some(u => url.startsWith(u))
  86     const isVideo = isPlaylist ? false : startVideoURLs.some(u => url.startsWith(u))
  87
  88     const startIsOk = isVideo || isPlaylist
  89
  90     const parts = urlPath.split('/')
  91
  92     if (startIsOk === false || parts.length === 0) {
  93       return res.fail({
  94         status: HttpStatusCode.BAD_REQUEST_400,
  95         message: 'Invalid url.',
  96         data: {
  97           url
  98         }
  99       })
 100     }
 101
 102     const elementId = toCompleteUUID(parts.pop())
 103     if (isIdOrUUIDValid(elementId) === false) {
 104       return res.fail({ message: 'Invalid video or playlist id.' })
 105     }
 106
 107     if (isVideo) {
 108       const video = await loadVideo(elementId, 'all')
 109
 110       if (!video) {
 111         return res.fail({
 112           status: HttpStatusCode.NOT_FOUND_404,
 113           message: 'Video not found'
 114         })
 115       }
 116
 117       if (
 118         video.privacy === VideoPrivacy.PUBLIC ||
 119         (video.privacy === VideoPrivacy.UNLISTED && isUUIDValid(elementId) === true)
 120       ) {
 121         res.locals.videoAll = video
 122         return next()
 123       }
 124
 125       return res.fail({
 126         status: HttpStatusCode.FORBIDDEN_403,
 127         message: 'Video is not publicly available'
 128       })
 129     }
 130
 131     // Is playlist
 132
 133     const videoPlaylist = await VideoPlaylistModel.loadWithAccountAndChannelSummary(elementId, undefined)
 134     if (!videoPlaylist) {
 135       return res.fail({
 136         status: HttpStatusCode.NOT_FOUND_404,
 137         message: 'Video playlist not found'
 138       })
 139     }
 140
 141     if (
 142       videoPlaylist.privacy === VideoPlaylistPrivacy.PUBLIC ||
 143       (videoPlaylist.privacy === VideoPlaylistPrivacy.UNLISTED && isUUIDValid(elementId))
 144     ) {
 145       res.locals.videoPlaylistSummary = videoPlaylist
 146       return next()
 147     }
 148
 149     return res.fail({
 150       status: HttpStatusCode.FORBIDDEN_403,
 151       message: 'Playlist is not public'
 152     })
 153   }
 154
 155 ]
 156
 157 // ---------------------------------------------------------------------------
 158
 159 export {
 160   oembedValidator
 161 }