diff --git a/src/invidious/routes/api/v1/authenticated.cr b/src/invidious/routes/api/v1/authenticated.cr index d006d5f2c..ebbbc2a76 100644 --- a/src/invidious/routes/api/v1/authenticated.cr +++ b/src/invidious/routes/api/v1/authenticated.cr @@ -98,12 +98,12 @@ module Invidious::Routes::API::V1::Authenticated return error_json(409, "Watch history is disabled in preferences.") end - id = env.params.url["id"] - if !id.match(/^[a-zA-Z0-9_-]{11}$/) - return error_json(400, "Invalid video id.") + video_id = env.params.url["id"] + unless video_id && validate_video_id(video_id) + return error_json(400, InvalidVideoID.new(video_id)) end - Invidious::Database::Users.mark_unwatched(user, id) + Invidious::Database::Users.mark_unwatched(user, video_id) env.response.status_code = 204 end diff --git a/src/invidious/routes/api/v1/videos.cr b/src/invidious/routes/api/v1/videos.cr index bd76b005b..5600e30dc 100644 --- a/src/invidious/routes/api/v1/videos.cr +++ b/src/invidious/routes/api/v1/videos.cr @@ -257,11 +257,11 @@ module Invidious::Routes::API::V1::Videos def self.annotations(env) env.response.content_type = "text/xml" - id = env.params.url["id"] + video_id = env.params.url["id"] source = env.params.query["source"]? source ||= "archive" - if !id.match(/[a-zA-Z0-9_-]{11}/) + unless video_id && validate_video_id(video_id) haltf env, 400 end @@ -269,21 +269,21 @@ module Invidious::Routes::API::V1::Videos case source when "archive" - if CONFIG.cache_annotations && (cached_annotation = Invidious::Database::Annotations.select(id)) + if CONFIG.cache_annotations && (cached_annotation = Invidious::Database::Annotations.select(video_id)) annotations = cached_annotation.annotations else - index = CHARS_SAFE.index!(id[0]).to_s.rjust(2, '0') + index = CHARS_SAFE.index!(video_id[0]).to_s.rjust(2, '0') # IA doesn't handle leading hyphens, # so we use https://archive.org/details/youtubeannotations_64 if index == "62" index = "64" - id = id.sub(/^-/, 'A') + video_id = video_id.sub(/^-/, 'A') end - file = URI.encode_www_form("#{id[0, 3]}/#{id}.xml") + file = URI.encode_www_form("#{video_id[0, 3]}/#{video_id}.xml") - location = make_client(INTERNET_ARCHIVE_URL, &.get("/download/youtubeannotations_#{index}/#{id[0, 2]}.tar/#{file}")) + location = make_client(INTERNET_ARCHIVE_URL, &.get("/download/youtubeannotations_#{index}/#{video_id[0, 2]}.tar/#{file}")) if !location.headers["Location"]? env.response.status_code = location.status_code @@ -301,10 +301,10 @@ module Invidious::Routes::API::V1::Videos annotations = response.body - Helpers.cache_annotation(id, annotations) + Helpers.cache_annotation(video_id, annotations) end else # "youtube" - response = YT_POOL.client &.get("/annotations_invideo?video_id=#{id}") + response = YT_POOL.client &.get("/annotations_invideo?video_id=#{video_id}") if response.status_code != 200 haltf env, response.status_code