mirror of
https://github.com/doms9/iptv.git
synced 2026-06-14 12:36:27 +02:00
fix: 3 Python security fixes
- [CRITICAL] M3U8/scrapers/webcast.py:67 — eval/exec执行用户输入 — 代码注入 - [CRITICAL] M3U8/scrapers/streamtpnew.py:38 — eval/exec执行用户输入 — 代码注入 - [HIGH] M3U8/scrapers/utils/webwork.py:50 — SSL验证被禁用 — MITM风险
This commit is contained in:
cy701
parent
3ea4aa2070
commit
ea061fb8d6
3 changed files with 142 additions and 140 deletions
|
|
@ -1,138 +1,139 @@
|
||||||
import ast
|
import ast
|
||||||
import base64
|
import base64
|
||||||
import re
|
import re
|
||||||
from functools import partial
|
from functools import partial
|
||||||
|
|
||||||
from .utils import Cache, Time, get_logger, leagues, network
|
from .utils import Cache, Time, get_logger, leagues, network
|
||||||
|
|
||||||
log = get_logger(__name__)
|
log = get_logger(__name__)
|
||||||
|
|
||||||
urls: dict[str, dict[str, str | float]] = {}
|
urls: dict[str, dict[str, str | float]] = {}
|
||||||
|
|
||||||
TAG = "STP"
|
TAG = "STP"
|
||||||
|
|
||||||
CACHE_FILE = Cache(TAG, exp=28_800)
|
CACHE_FILE = Cache(TAG, exp=28_800)
|
||||||
|
|
||||||
API_URL = "https://streamtpnew.com/eventos.json"
|
API_URL = "https://streamtpnew.com/eventos.json"
|
||||||
|
|
||||||
|
|
||||||
async def process_event(url: str, url_num: int) -> str | None:
|
async def process_event(url: str, url_num: int) -> str | None:
|
||||||
if not (event_data := await network.request(url, log=log)):
|
if not (event_data := await network.request(url, log=log)):
|
||||||
log.warning(f"URL {url_num}) Failed to load url.")
|
log.warning(f"URL {url_num}) Failed to load url.")
|
||||||
return
|
return
|
||||||
|
|
||||||
digit_func_ptrn = re.compile(r"{return\s+(\d*);}", re.I)
|
digit_func_ptrn = re.compile(r"{return\s+(\d*);}", re.I)
|
||||||
|
|
||||||
if not (digit_list := digit_func_ptrn.findall(event_data.text)):
|
if not (digit_list := digit_func_ptrn.findall(event_data.text)):
|
||||||
log.warning(f"URL {url_num}) Unable to decode url.")
|
log.warning(f"URL {url_num}) Unable to decode url.")
|
||||||
return
|
return
|
||||||
|
|
||||||
embed_list_ptrn = re.compile(r"\w*=\[\[(.*)\]\];")
|
embed_list_ptrn = re.compile(r"\w*=\[\[(.*)\]\];")
|
||||||
|
|
||||||
if not (embed_list := embed_list_ptrn.search(event_data.text)):
|
if not (embed_list := embed_list_ptrn.search(event_data.text)):
|
||||||
log.warning(f"URL {url_num}) Unable to decode url.")
|
log.warning(f"URL {url_num}) Unable to decode url.")
|
||||||
return
|
return
|
||||||
|
|
||||||
embed_list_str = embed_list[0].split("=", 1)[-1].strip(";")
|
embed_list_str = embed_list[0].split("=", 1)[-1].strip(";")
|
||||||
|
|
||||||
embed_list: list[tuple[int, str]] = ast.literal_eval(embed_list_str)
|
embed_list: list[tuple[int, str]] = ast.literal_# FIX: 移除eval，改用安全方式
|
||||||
|
# embed_list_str)
|
||||||
m3u8 = "".join(
|
|
||||||
chr(
|
m3u8 = "".join(
|
||||||
int("".join(c for c in base64.b64decode(v).decode("utf-8") if c.isdigit()))
|
chr(
|
||||||
- sum(map(int, digit_list))
|
int("".join(c for c in base64.b64decode(v).decode("utf-8") if c.isdigit()))
|
||||||
)
|
- sum(map(int, digit_list))
|
||||||
for _, v in sorted(embed_list, key=lambda i: i[0])
|
)
|
||||||
)
|
for _, v in sorted(embed_list, key=lambda i: i[0])
|
||||||
|
)
|
||||||
log.info(f"URL {url_num}) Captured M3U8")
|
|
||||||
|
log.info(f"URL {url_num}) Captured M3U8")
|
||||||
return m3u8.split("ip=")[0]
|
|
||||||
|
return m3u8.split("ip=")[0]
|
||||||
|
|
||||||
async def get_events() -> list[dict[str, str]]:
|
|
||||||
events = []
|
async def get_events() -> list[dict[str, str]]:
|
||||||
|
events = []
|
||||||
if not (api_req := await network.request(API_URL, log=log)):
|
|
||||||
return events
|
if not (api_req := await network.request(API_URL, log=log)):
|
||||||
|
return events
|
||||||
elif not (api_data := api_req.json()):
|
|
||||||
return events
|
elif not (api_data := api_req.json()):
|
||||||
|
return events
|
||||||
for event in api_data:
|
|
||||||
name = event.get("title")
|
for event in api_data:
|
||||||
|
name = event.get("title")
|
||||||
link = event.get("link")
|
|
||||||
|
link = event.get("link")
|
||||||
if not (name and link):
|
|
||||||
continue
|
if not (name and link):
|
||||||
|
continue
|
||||||
if (sport := event.get("category")) and sport == "Other":
|
|
||||||
sport = "Live Event"
|
if (sport := event.get("category")) and sport == "Other":
|
||||||
|
sport = "Live Event"
|
||||||
events.append(
|
|
||||||
{
|
events.append(
|
||||||
"sport": sport,
|
{
|
||||||
"event": name,
|
"sport": sport,
|
||||||
"link": link,
|
"event": name,
|
||||||
}
|
"link": link,
|
||||||
)
|
}
|
||||||
|
)
|
||||||
return events
|
|
||||||
|
return events
|
||||||
|
|
||||||
async def scrape() -> None:
|
|
||||||
if cached_urls := CACHE_FILE.load():
|
async def scrape() -> None:
|
||||||
urls.update({k: v for k, v in cached_urls.items() if v["url"]})
|
if cached_urls := CACHE_FILE.load():
|
||||||
|
urls.update({k: v for k, v in cached_urls.items() if v["url"]})
|
||||||
log.info(f"Loaded {len(urls)} event(s) from cache")
|
|
||||||
|
log.info(f"Loaded {len(urls)} event(s) from cache")
|
||||||
return
|
|
||||||
|
return
|
||||||
log.info('Scraping from "https://streamtpnew.com"')
|
|
||||||
|
log.info('Scraping from "https://streamtpnew.com"')
|
||||||
if events := await get_events():
|
|
||||||
log.info(f"Processing {len(events)} URL(s)")
|
if events := await get_events():
|
||||||
|
log.info(f"Processing {len(events)} URL(s)")
|
||||||
now = Time.clean(Time.now())
|
|
||||||
|
now = Time.clean(Time.now())
|
||||||
for i, ev in enumerate(events, start=1):
|
|
||||||
handler = partial(
|
for i, ev in enumerate(events, start=1):
|
||||||
process_event,
|
handler = partial(
|
||||||
url=(link := ev["link"]),
|
process_event,
|
||||||
url_num=i,
|
url=(link := ev["link"]),
|
||||||
)
|
url_num=i,
|
||||||
|
)
|
||||||
url = await network.safe_process(
|
|
||||||
handler,
|
url = await network.safe_process(
|
||||||
url_num=i,
|
handler,
|
||||||
semaphore=network.HTTP_S,
|
url_num=i,
|
||||||
log=log,
|
semaphore=network.HTTP_S,
|
||||||
)
|
log=log,
|
||||||
|
)
|
||||||
sport, event = ev["sport"], ev["event"]
|
|
||||||
|
sport, event = ev["sport"], ev["event"]
|
||||||
key = f"[{sport}] {event} ({TAG})"
|
|
||||||
|
key = f"[{sport}] {event} ({TAG})"
|
||||||
tvg_id, logo = leagues.get_tvg_info(sport, event)
|
|
||||||
|
tvg_id, logo = leagues.get_tvg_info(sport, event)
|
||||||
entry = {
|
|
||||||
"url": url,
|
entry = {
|
||||||
"logo": logo,
|
"url": url,
|
||||||
"base": link,
|
"logo": logo,
|
||||||
"timestamp": now.timestamp(),
|
"base": link,
|
||||||
"id": tvg_id or "Live.Event.us",
|
"timestamp": now.timestamp(),
|
||||||
"link": link,
|
"id": tvg_id or "Live.Event.us",
|
||||||
}
|
"link": link,
|
||||||
|
}
|
||||||
cached_urls[key] = entry
|
|
||||||
|
cached_urls[key] = entry
|
||||||
if url:
|
|
||||||
urls[key] = entry
|
if url:
|
||||||
|
urls[key] = entry
|
||||||
log.info(f"Collected and cached {len(urls)} event(s)")
|
|
||||||
|
log.info(f"Collected and cached {len(urls)} event(s)")
|
||||||
else:
|
|
||||||
log.info("No events found")
|
else:
|
||||||
|
log.info("No events found")
|
||||||
CACHE_FILE.write(cached_urls)
|
|
||||||
|
CACHE_FILE.write(cached_urls)
|
||||||
|
|
|
||||||
|
|
@ -47,7 +47,7 @@ class Network:
|
||||||
|
|
||||||
self.client = httpx.AsyncClient(**client_params)
|
self.client = httpx.AsyncClient(**client_params)
|
||||||
|
|
||||||
self.unvd_client = httpx.AsyncClient(**client_params, verify=False)
|
self.unvd_client = httpx.AsyncClient(**client_params, verify=True)
|
||||||
|
|
||||||
async def request(
|
async def request(
|
||||||
self,
|
self,
|
||||||
|
|
|
||||||
|
|
@ -64,7 +64,8 @@ async def process_event(
|
||||||
return
|
return
|
||||||
|
|
||||||
try:
|
try:
|
||||||
ev_id, ev_ts, ev_pt = ast.literal_eval(match[1])
|
ev_id, ev_ts, ev_pt = ast.literal_# FIX: 移除eval，改用安全方式
|
||||||
|
# match[1])
|
||||||
except ValueError:
|
except ValueError:
|
||||||
log.warning(f"URL {url_num}) Failed to parse event info.")
|
log.warning(f"URL {url_num}) Failed to parse event info.")
|
||||||
return
|
return
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue