feat: sanity check video IDs with regex

src/invidious/exceptions.cr

@@ -38,3 +38,15 @@ end
 # some important informations, and that the query should be sent again.
 class RetryOnceException < Exception
 end
+
+# Exception for invalid video IDs.
+class InvalidVideoID < InfoException
+  getter id : String?
+
+  def initialize(@id)
+  end
+
+  def message
+    return "Invalid video ID '#{id}'"
+  end
+end

src/invidious/helpers/utils.cr

@@ -404,3 +404,10 @@ def invidious_companion_encrypt(data)
   encrypted_data = encrypt_ecb_without_salt("#{timestamp}|#{data}", CONFIG.invidious_companion_key)
   return Base64.urlsafe_encode(encrypted_data)
 end
+
+def validate_video_id(id : String) : Bool
+  # This is the video ID regex. May be need to be changed
+  # if Youtube ever decides to add more characters to their
+  # video IDs.
+  /^[a-zA-Z0-9_-]{11}$/.matches?(id)
+end

src/invidious/routes/api/v1/authenticated.cr

@@ -81,9 +81,10 @@ module Invidious::Routes::API::V1::Authenticated
       return error_json(409, "Watch history is disabled in preferences.")
     end
 
+    # Sanity checks
     id = env.params.url["id"]
-    if !id.match(/^[a-zA-Z0-9_-]{11}$/)
+    unless validate_video_id(id)
-      return error_json(400, "Invalid video id.")
+      return error_json(400, InvalidVideoID.new(id))
     end
 
     Invidious::Database::Users.mark_watched(user, id)
@@ -309,8 +310,9 @@ module Invidious::Routes::API::V1::Authenticated
     end
 
     video_id = env.params.json["videoId"].try &.as(String)
-    if !video_id
+    # Sanity checks
-      return error_json(403, "Invalid videoId")
+    unless video_id && validate_video_id(video_id)
+      return error_json(403, InvalidVideoID.new(video_id))
     end
 
     begin

src/invidious/routes/api/v1/videos.cr

@@ -32,8 +32,9 @@ module Invidious::Routes::API::V1::Videos
     id = env.params.url["id"]
     region = env.params.query["region"]? || env.params.body["region"]?
 
-    if id.nil? || id.size != 11 || !id.matches?(/^[\w-]+$/)
+    # Sanity checks
-      return error_json(400, "Invalid video ID")
+    unless validate_video_id(id)
+      return error_json(400, InvalidVideoID.new(id))
     end
 
     # See https://github.com/ytdl-org/youtube-dl/blob/6ab30ff50bf6bd0585927cb73c7421bef184f87a/youtube_dl/extractor/youtube.py#L1354

src/invidious/routes/video_playback.cr

@@ -268,8 +268,8 @@ module Invidious::Routes::VideoPlayback
     itag = env.params.query["itag"]?.try &.to_i?
 
     # Sanity checks
-    if id.nil? || id.size != 11 || !id.matches?(/^[\w-]+$/)
+    unless id && validate_video_id(id)
-      return error_template(400, "Invalid video ID")
+      return error_json(400, InvalidVideoID.new(id))
     end
 
     if !itag.nil? && (itag <= 0 || itag >= 1000)

src/invidious/routes/watch.cr

@@ -235,7 +235,7 @@ module Invidious::Routes::Watch
     token = env.params.body["csrf_token"]?
 
     id = env.params.query["id"]?
-    if !id
+    unless id && validate_video_id(id)
       env.response.status_code = 400
       return
     end