fix: only accept youtube domains from ytdl.validateURL() and `ytdl.…

…getURLVideoID()`'
fent · Aug 5, 2018 · 2674165 · 2674165
1 parent e544f5a
commit 2674165
Show file tree

Hide file tree

Showing 2 changed files with 32 additions and 12 deletions.
diff --git a/lib/util.js b/lib/util.js
@@ -234,23 +234,37 @@ exports.between = (haystack, left, right) => {
  * Get video ID.
  *
  * There are a few type of video URL formats.
- *  - http://www.youtube.com/watch?v=VIDEO_ID
- *  - http://m.youtube.com/watch?v=VIDEO_ID
- *  - http://youtu.be/VIDEO_ID
- *  - http://www.youtube.com/v/VIDEO_ID
- *  - http://www.youtube.com/embed/VIDEO_ID
+ *  - https://www.youtube.com/watch?v=VIDEO_ID
+ *  - https://m.youtube.com/watch?v=VIDEO_ID
+ *  - https://youtu.be/VIDEO_ID
+ *  - https://www.youtube.com/v/VIDEO_ID
+ *  - https://www.youtube.com/embed/VIDEO_ID
+ *  - https://music.youtube.com/watch?v=VIDEO_ID
+ *  - https://gaming.youtube.com/watch?v=VIDEO_ID
  *
  * @param {String} link
  * @return {String|Error}
  */
+const validQueryDomains = new Set([
+  'youtube.com',
+  'www.youtube.com',
+  'm.youtube.com',
+  'music.youtube.com',
+  'gaming.youtube.com',
+]);
+const validPathDomains = new Set([
+  'youtu.be',
+  'youtube.com',
+  'www.youtube.com',
+]);
 exports.getURLVideoID = function(link) {
   const parsed = url.parse(link, true);
   let id = parsed.query.v;
-  if (parsed.hostname === 'youtu.be' ||
-     (parsed.hostname === 'youtube.com' ||
-      parsed.hostname === 'www.youtube.com') && !id) {
-    const s = parsed.pathname.split('/');
-    id = s[s.length - 1];
+  if (validPathDomains.has(parsed.hostname) && !id) {
+    const paths = parsed.pathname.split('/');
+    id = paths[paths.length - 1];
+  } else if (parsed.hostname && !validQueryDomains.has(parsed.hostname)) {
+    return new Error('Not a YouTube domain');
   }
   if (!id) {
     return new Error('No video id found: ' + link);

diff --git a/test/util-test.js b/test/util-test.js
@@ -319,8 +319,14 @@ describe('util.getURLVideoID()', () => {
     assert.equal(id, 'RAW_VIDEOID');
     id = util.getVideoID('http://youtube.com/embed/RAW_VIDEOID');
     assert.equal(id, 'RAW_VIDEOID');
+    id = util.getVideoID('https://music.youtube.com/watch?v=RAW_VIDEOID&list=RDAMVMmtLgabce8KQ');
+    assert.equal(id, 'RAW_VIDEOID');
+    id = util.getVideoID('https://gaming.youtube.com/watch?v=RAW_VIDEOID');
+    assert.equal(id, 'RAW_VIDEOID');
+    id = util.getVideoID('https://any.youtube.com/watch?v=RAW_VIDEOID');
+    assert.equal(id.message, 'Not a YouTube domain');
     id = util.getVideoID('https://www.twitch.tv/user/v/1234');
-    assert.equal(id.message, 'No video id found: https://www.twitch.tv/user/v/1234');
+    assert.equal(id.message, 'Not a YouTube domain');
     id = util.getVideoID('www.youtube.com');
     assert.equal(id.message, 'No video id found: www.youtube.com');
     id = util.getVideoID('http://www.youtube.com/playlist?list=1337');
@@ -347,7 +353,7 @@ describe('util.getVideoID()', () => {
     id = util.getVideoID('RAW_VIDEOID'); // Video ids are 11-character long
     assert.equal(id, 'RAW_VIDEOID');
     id = util.getVideoID('https://www.twitch.tv/user/v/1234');
-    assert.equal(id.message, 'No video id found: https://www.twitch.tv/user/v/1234');
+    assert.equal(id.message, 'Not a YouTube domain');
     id = util.getVideoID('www.youtube.com');
     assert.equal(id.message, 'No video id found: www.youtube.com');
     id = util.getVideoID('http://www.youtube.com/playlist?list=1337');