douyin: fix a_bogus signature and room info retrieval - #188
Open
iwestlin wants to merge 3 commits into
Open
Conversation
- Add ABogus signature algorithm implementation (SM3, RC4, custom Base64) (stole from here: https://github.com/renmu123/biliLive-tools/blob/a7f91e4e567d630f287fc45126657f932eace58c/packages/DouYinRecorder/src/douyin_api.ts#L314) - Fix User-Agent to use Chrome 130 (required by Douyin) - Fix nickname field path (owner.nickname) - Set room info regardless of live status - Update dependencies (gmsm, golang.org/x/text) Vibe coding with Claude Code and third party LLM :)
Author
|
try to fix: #186 |
added 2 commits
July 19, 2026 10:25
…th traversal - auth: add HMAC-SHA256 signed session cookies + Authenticate middleware gated onto /v1/shows/* and /v1/configs/*; /v1/user/login now uses crypto/subtle comparison and is rate-limited by a per (IP, user) exponential-backoff lockout - post cmds: enforce a whitelist (olivetrash/olivearchive/olivebiliup/ oliveshell) at validate.CheckPostCmds and engine ingestion; the uploader default handler now refutes unknown paths instead of running Cmd.Args[0] verbatim via exec.Command, closing the previous RCE - path safety: add validate.CheckSafePath / CheckSafeFilename and apply on show SaveDir/OutTmpl at create/update; reject '..', absolute paths and NUL bytes - deployment defaults: API and debug listeners default to 127.0.0.1; refuse to expose debug on a non-loopback address without basic-auth; warn when API is exposed without TLS - TLS: support --web-tls-cert/--web-tls-key (and the OLIVE_ env forms) so admin credentials can travel over HTTPS at the perimeter - body limit: cap incoming JSON bodies at 1 MiB via http.MaxBytesReader - bug fix: wire the four web timeout flags to four distinct fields; previously WriteTimeout/IdleTimeout/ShutdownTimeout all wrote to ReadTimeout, silently leaving them at zero - engine: issue a one-shot warning when the default olive/olive portal credentials are still in effect - db Show -> kernel Show: drop unsafe.Pointer aliasing in favor of an explicit field copy to avoid latent memory-corruption risk - tests: cover session issue/verify/tamper, lockout backoff, Authenticate 401/allow, post-cmd whitelist (incl. /bin/sh RCE rejection) and path-traversal rejection
Document all changes introduced in commit 4cf2a8d: - Default listen addresses are now loopback (127.0.0.1:3000 / 127.0.0.1:4000) instead of 0.0.0.0; flag help reflects the change - New flags: --web-tls-cert/--web-tls-key (TLS termination) and --web-debug-user/--web-debug-pass (Basic-Auth on pprof/expvar) - Historical bug fix note: write/idle/shutdown timeouts were silently wired to ReadTimeout and have been re-wired - /v1/user/login now signs an HttpOnly SameSite=Lax cookie (HMAC-SHA256, 12h TTL); /v1/shows/* and /v1/configs/* require this session via a new Authenticate middleware; X-Olive-Session header is the cookie-less fallback - Login uses crypto/subtle comparison and is rate-limited by a per (IP, username) exponential-backoff lockout - PostCmds are restricted to a whitelist (olivetrash/olivearchive/ olivebiliup/oliveshell); unknown paths are rejected at validation and refused again by the uploader default handler - SaveDir/OutTmpl are validated against parent traversal, absolute paths and NUL bytes - Request bodies are capped at 1 MiB via http.MaxBytesReader - Migrate the curl examples to use 127.0.0.1, cookie.txt, and b/ -b flags so they reflect the authenticated flow - Add a 'Security model and hardening' section summarizing every closed risk with a comparison table and an upgrade checklist - Add FAQ entries for the new 401/429/400 'unsafe path' errors and the 'debug listener refused to start' startup guard
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Vibe coding with Claude Code and third party LLM :)