Repository navigation
Vimeo: ask player.vimeo.com only (code scanning #168) - #357
Merged
Merged
Conversation
The Vimeo player requested its source's URL, whatever host it named, with the source's headers. The background only gives it player.vimeo.com addresses, but a source's mode can also come from the player's address (faststream-mode=accelerated_vm) or the Sources browser's mode menu, so it could be pointed anywhere (CodeQL js/client-side-request-forgery #168, from the address's #url to RequestUtils' fetch). It now refuses any other host before a request, and asks on an address rebuilt on player.vimeo.com, which is byte-identical for Vimeo's own player and config addresses. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Nawid3333
added a commit
that referenced
this pull request
Oct 6, 2026
#168) (#358) #357 kept the Vimeo player's request on player.vimeo.com but passed the source's path through, and CodeQL's client-side request forgery rule still traced the player address's #url to RequestUtils' fetch: a path of the source's choosing reaches any endpoint on Vimeo's host, with the source's headers. Only /video/<number> and /video/<number>/config are asked for now, rebuilt from the number (encodeURIComponent) and the query (after a fixed '?'), the two things that rule takes as safe. Vimeo's own addresses are unchanged. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
@Nawid3333 The last of the five code scanning alerts. The other four (#164-#167,
tools/recut-patch.mjs) are fixed on main in 71b3305: a maintainer tool, no release.The alert (#168, client-side request forgery). The Vimeo player requested its source's URL, whatever host it named, with the source's headers. The background only hands it
player.vimeo.comaddresses, but a source's mode can also come from the player's address (faststream-mode=accelerated_vm) or the Sources browser's mode menu, so a crafted player address could point it at any host.The fix.
VMPlayer.vimeoRequestUrlaccepts onlyhttp(s)://player.vimeo.com/…and rebuilds the address on that fixed host; anything else is refused before any request. Vimeo's own player and config addresses come out byte-identical.Checked:
tests/unit/VMPlayer.test.mjs: real Vimeo addresses kept; other hosts, look-alikes, userinfo@, backslashes, a trailing dot, punycode and a Cyrillic look-alike refused; ports,//and..stay onplayer.vimeo.com; no request for a refused host. The refusal test fails without the fix.Your hand test (1 step). With
pnpm run start:ffon this branch, open a Vimeo video (vimeo.com/… or a page with a Vimeo embed): FastStream plays it as before. Then merge (that releases).🤖 Generated with Claude Code