🛡️ Sentinel: [CRITICAL] Fix authentication bypass in stream proxy - #471
🛡️ Sentinel: [CRITICAL] Fix authentication bypass in stream proxy#471xbmc4lyfe wants to merge 1 commit into
Conversation
Co-authored-by: xbmc4lyfe <273732874+xbmc4lyfe@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
📝 WalkthroughSummary by CodeRabbit
WalkthroughThe stream proxy dispatch layer adds prepare and fallback POST handling, bounded request validation, stream response cleanup, and HEAD/GET routing for regular and HLS media. Prepare-token checks now fail closed when the expected secret is absent. ChangesStream proxy dispatch
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant Client
participant _DispatchMixin
participant proxy
participant StreamContext
Client->>_DispatchMixin: POST /prepare
_DispatchMixin->>_DispatchMixin: Validate token and request body
_DispatchMixin->>proxy: Call prepare_stream
proxy-->>_DispatchMixin: Return stream metadata
Client->>_DispatchMixin: GET media or HLS resource
_DispatchMixin->>StreamContext: Acquire and validate context
StreamContext-->>Client: Return media response
_DispatchMixin->>StreamContext: Release context
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
✨ Simplify code
Warning Billing warning: we have not been able to collect payment for this subscription for more than 72 hours. Please update the payment method or pay any pending invoices in Billing to avoid service interruption. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Complexity | 0 |
| Duplication | 0 |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
repo/plugin.video.nzbdav/resources/lib/stream_proxy_handler_dispatch.py (1)
29-33: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueAlign the docstring with the fail-closed behavior.
Lines 29-33 reject missing tokens rather than coercing both values to
""; update Lines 25-26 so the documented behavior matches the implementation.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@repo/plugin.video.nzbdav/resources/lib/stream_proxy_handler_dispatch.py` around lines 29 - 33, Update the docstring for the token validation method surrounding the expected_token and supplied_token checks to document fail-closed behavior: missing expected or supplied tokens are rejected, not coerced to empty strings. Keep the existing validation logic unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@repo/plugin.video.nzbdav/resources/lib/stream_proxy_handler_dispatch.py.orig`:
- Around line 356-359: Ensure the stream context acquired by
_get_stream_context(acquire=True) is released before returning from the
invalid-context branch when ctx is None or its mode is not "hls". Preserve the
existing 404 response, and keep valid HLS requests flowing through the normal
release path.
---
Nitpick comments:
In `@repo/plugin.video.nzbdav/resources/lib/stream_proxy_handler_dispatch.py`:
- Around line 29-33: Update the docstring for the token validation method
surrounding the expected_token and supplied_token checks to document fail-closed
behavior: missing expected or supplied tokens are rejected, not coerced to empty
strings. Keep the existing validation logic unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 9e8457c2-c020-4cde-866e-d059d150b7cd
📒 Files selected for processing (3)
.jules/sentinel.mdrepo/plugin.video.nzbdav/resources/lib/stream_proxy_handler_dispatch.pyrepo/plugin.video.nzbdav/resources/lib/stream_proxy_handler_dispatch.py.orig
📜 Review details
⏰ Context from checks skipped due to timeout. (6)
- GitHub Check: Codacy Static Code Analysis
- GitHub Check: coverage
- GitHub Check: test
- GitHub Check: Analyze (python)
- GitHub Check: lint
- GitHub Check: Analyze (python)
🔇 Additional comments (1)
.jules/sentinel.md (1)
7-11: LGTM!
| ctx = self._get_stream_context(acquire=True) | ||
| if ctx is None or ctx.get("mode") != "hls": | ||
| self.send_error(404) | ||
| return |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Release contexts rejected for non-HLS mode.
Line 356 acquires the context, but the non-HLS return at Line 359 skips the finally release. A request to an HLS path for a live non-HLS session can leave that context acquired and pin the session.
Proposed fix
ctx = self._get_stream_context(acquire=True)
- if ctx is None or ctx.get("mode") != "hls":
+ if ctx is None:
self.send_error(404)
return
try:
+ if ctx.get("mode") != "hls":
+ self.send_error(404)
+ return
_session_id, resource = parsed
seg_fmt = ctx.get("hls_segment_format", "mpegts")📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| ctx = self._get_stream_context(acquire=True) | |
| if ctx is None or ctx.get("mode") != "hls": | |
| self.send_error(404) | |
| return | |
| ctx = self._get_stream_context(acquire=True) | |
| if ctx is None: | |
| self.send_error(404) | |
| return | |
| try: | |
| if ctx.get("mode") != "hls": | |
| self.send_error(404) | |
| return | |
| _session_id, resource = parsed | |
| seg_fmt = ctx.get("hls_segment_format", "mpegts") |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@repo/plugin.video.nzbdav/resources/lib/stream_proxy_handler_dispatch.py.orig`
around lines 356 - 359, Ensure the stream context acquired by
_get_stream_context(acquire=True) is released before returning from the
invalid-context branch when ctx is None or its mode is not "hls". Preserve the
existing 404 response, and keep valid HLS requests flowing through the normal
release path.
1 participant
🚨 Severity: CRITICAL
💡 Vulnerability: Stream proxy dispatch token check bypasses authentication when
expected_tokenis missing or empty.🎯 Impact: Unauthenticated attackers can access critical endpoints like
/prepareand/fallbacks.🔧 Fix: Ensure
_prepare_token_okexplicitly fails closed whenexpected_tokenis falsy and correctly checkssupplied_token.✅ Verification: Covered by existing tests.
PR created automatically by Jules for task 9880259692204535171 started by @xbmc4lyfe