初始提交：短剧库源码（含转码优化 ultrafast）

2026-09-17 19:09:08 +08:00
commit 07dc0f1059
247 changed files with 43242 additions and 0 deletions
@@ -0,0 +1,100 @@
+package app
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/http/httputil"
+	"net/url"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestPlaybackRequestOriginPolicy(t *testing.T) {
+	for _, test := range []struct {
+		name, method, host, site, origin, forwarded string
+		want                                        int
+	}{
+		{"proxy same origin", "POST", "127.0.0.1:8998", "same-origin", "https://library.example.invalid:9443", "", 204},
+		{"direct navigation", "POST", "127.0.0.1:8998", "none", "https://library.example.invalid", "", 204},
+		{"direct older browser", "POST", "library.example.invalid:8998", "", "http://library.example.invalid:8998", "", 204},
+		{"LAN IP direct", "POST", "192.168.1.5:8998", "", "http://192.168.1.5:8998", "", 204},
+		{"LAN IP proxy same origin", "POST", "127.0.0.1:8998", "same-origin", "http://192.168.1.5:8998", "", 204},
+		{"default https port", "POST", "library.example.invalid:443", "", "https://library.example.invalid", "", 204},
+		{"default http port", "POST", "library.example.invalid:80", "", "http://library.example.invalid", "", 204},
+		{"ipv6 default port", "POST", "[::1]:80", "", "http://[::1]", "", 204},
+		{"case insensitive host", "POST", "LIBRARY.EXAMPLE.INVALID:8998", "", "http://library.example.invalid:8998", "", 204},
+		{"API client", "POST", "127.0.0.1:8998", "", "", "", 204},
+		{"cross site", "POST", "library.example.invalid", "cross-site", "https://library.example.invalid", "", 403},
+		{"same site is not same origin", "POST", "library.example.invalid", "same-site", "https://library.example.invalid", "", 403},
+		{"unrecognized fetch metadata", "POST", "library.example.invalid", "unrecognized", "https://library.example.invalid", "", 403},
+		{"foreign older browser", "POST", "library.example.invalid", "", "https://other.example.invalid", "", 403},
+		{"untrusted forwarded host", "POST", "library.example.invalid", "", "https://other.example.invalid", "other.example.invalid", 403},
+		{"different port", "POST", "library.example.invalid:8998", "", "http://library.example.invalid:8999", "", 403},
+		{"default port wrong scheme", "POST", "library.example.invalid:443", "", "http://library.example.invalid", "", 403},
+		{"opaque origin", "POST", "library.example.invalid", "", "null", "", 403},
+		{"credentials in origin", "POST", "library.example.invalid", "", "https://user@library.example.invalid", "", 403},
+		{"wrong method", "GET", "127.0.0.1:8998", "same-origin", "", "", 405},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			request := httptest.NewRequest(test.method, "http://localhost/api/ui/playback/open", nil)
+			request.Host = test.host
+			request.Header.Set("Sec-Fetch-Site", test.site)
+			request.Header.Set("Origin", test.origin)
+			request.Header.Set("X-Forwarded-Host", test.forwarded)
+			request.Header.Set("Forwarded", "host="+test.forwarded+";proto=https")
+			writer := httptest.NewRecorder()
+			if playbackRequestAllowed(writer, request, http.MethodPost) {
+				writer.WriteHeader(http.StatusNoContent)
+			}
+			if writer.Code != test.want {
+				t.Fatalf("got %d, want %d: %s", writer.Code, test.want, writer.Body.String())
+			}
+		})
+	}
+}
+
+func TestPlaybackRequestThroughHostRewritingProxy(t *testing.T) {
+	upstream := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
+		var input struct {
+			DramaID string `json:"dramaId"`
+		}
+		if !readPlaybackRequest(writer, request, &input) {
+			return
+		}
+		writer.WriteHeader(http.StatusNoContent)
+	}))
+	defer upstream.Close()
+	target, _ := url.Parse(upstream.URL)
+	proxy := httputil.NewSingleHostReverseProxy(target)
+	director := proxy.Director
+	proxy.Director = func(request *http.Request) {
+		director(request)
+		request.Header.Set("X-Forwarded-Host", request.Host)
+		request.Host = target.Host
+	}
+	public := httptest.NewServer(proxy)
+	defer public.Close()
+	client := &http.Client{Transport: &http.Transport{Proxy: nil}, Timeout: 3 * time.Second}
+	defer client.CloseIdleConnections()
+	for _, site := range []string{"same-origin", "cross-site", "same-site"} {
+		request, _ := http.NewRequest(http.MethodPost, public.URL+"/api/ui/playback/open", strings.NewReader(`{"dramaId":"hongguo:7000000000000000001"}`))
+		request.Header.Set("Content-Type", "application/json")
+		request.Header.Set("Origin", "https://library.example.invalid:9443")
+		request.Header.Set("Sec-Fetch-Site", site)
+		response, err := client.Do(request)
+		if err != nil {
+			t.Fatal(err)
+		}
+		body, _ := io.ReadAll(response.Body)
+		response.Body.Close()
+		want := http.StatusForbidden
+		if site == "same-origin" {
+			want = http.StatusNoContent
+		}
+		if response.StatusCode != want {
+			t.Fatalf("proxy %s got %d, want %d: %s", site, response.StatusCode, want, body)
+		}
+	}
+}