Repository navigation
Conversation
… belong to Browser cookies and saved site credentials are captured for the URL the user added. Requests that end up on a different host (after a redirect, or a variant playlist / segment served from elsewhere) now go out without them, matching how reqwest already treats redirect hops. Adds `request_scope` with the shared host check and unit tests.
Stream (HLS) output names can come from the caller, the page title or the URL path. Run them through `sanitize_filename` like regular downloads so they get the same cleanup.
`open_file` shelled out to `cmd /C start` on Windows. Use the `open` crate instead (ShellExecuteW on Windows, `open` on macOS, xdg-open on Linux), so all three platforms go through the same code path.
`/api/downloads` serialised the internal `Download` model directly. Return a `DownloadSummary` with just the fields the extension uses instead, so the API shape no longer changes whenever `Download` gains a field. Includes a test for the projection.
The local browser-integration server exists for the DLMan extension. Serve requests whose `Origin` is a browser-extension scheme (chrome-extension, moz-extension, safari-web-extension) and answer anything else with 403. Requests without an `Origin` header are still accepted, since Chrome can omit it for extension fetches.
The server binds 127.0.0.1 and the extension calls it as `localhost:<port>`. Check the `Host` header against the loopback names (`localhost`, `127.0.0.1`, `[::1]`, optionally with a port) and answer anything else with 403. Includes unit tests for the host check.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Small, independent fixes across core and desktop. One commit per change.
Core
request_scopemodule with tests.sanitize_filename, like regular downloads.Desktop
open_file: replacecmd /C startwith theopencrate, which uses the OS default handler (ShellExecuteW on Windows).openmoves 5.3.3 → 5.4.4; it was already a dependency oftauri-plugin-shell./api/downloads: return aDownloadSummarywith only the fields the extension uses, instead of the fullDownload.Originis not an extension scheme, or whoseHostis notlocalhost,127.0.0.1or[::1]. Requests without anOriginare still allowed.Notes
http→httpsupgrades are unaffected.Testing
cargo test -p dlman-coreand-p dlman-desktoppass, exceptmedia::dash::tests::test_parse_simple_mpd, which already fails onmain.