mirror of
https://github.com/Shineii86/AniKotoAPI.git
synced 2026-10-22 02:45:10 +00:00
Shinei Nouzen
30fdcd93c2
Security:
- Fixed unauthenticated SSRF in /api/stream/proxy and /api/stream/ts-proxy
- proxy allowlist had escape hatch via pathname.endsWith('.m3u8') bypass
- ts-proxy had no destination validation at all
- Both could fetch internal services (127.0.0.1, 169.254.169.254)
- Added streamProxy.helper.js with domain allowlist, private IP blocking,
and http(s)-only enforcement applied to both endpoints
- Removed dead megaplay-1.buzz; added vid-tube.site, norami.top,
kryntal.top, akirax.buzz to allowlist
- Added SECURITY.md with vulnerability reporting policy
Bug fix:
- Fixed dotenv.config() loading after static imports -- helpers reading
process.env at top level never received .env values. Changed to
import 'dotenv/config' as first import
Config:
- Added STREAM_PROXY_DOMAINS env var for custom allowlist
- Added STREAM_PROXY_REFERER env var for custom CDN Referer
37 lines
1.2 KiB
Bash
37 lines
1.2 KiB
Bash
# Origins you want to allow
|
|
ALLOWED_ORIGINS=https://site1.com,https://site2.com
|
|
|
|
# Port (optional, defaults to 4444)
|
|
PORT=4444
|
|
|
|
# Cache configuration
|
|
CACHE_MAX_SIZE=200
|
|
CACHE_DEFAULT_TTL=300000
|
|
|
|
# Rate limiting
|
|
RATE_LIMIT=100
|
|
RATE_WINDOW=60000
|
|
|
|
# Request timeout in milliseconds
|
|
REQUEST_TIMEOUT=30000
|
|
|
|
# Mirror configuration
|
|
# Comma-separated list of mirror domains (in priority order)
|
|
# Default: anikototv.to,anikoto.cz,anikoto.me,anikoto.net,anikototv.se
|
|
MIRROR_DOMAINS=https://anikototv.to,https://anikoto.cz,https://anikoto.me,https://anikoto.net,https://anikototv.se
|
|
|
|
# Mirror cache TTL in milliseconds (default: 1 hour)
|
|
MIRROR_CACHE_TTL=3600000
|
|
|
|
# Environment (production/development)
|
|
NODE_ENV=production
|
|
|
|
# Domains the M3U8/TS stream proxies may fetch from (comma-separated).
|
|
# Subdomains are covered automatically, so list the registrable domain only.
|
|
# Leave unset to use the built-in defaults.
|
|
# STREAM_PROXY_DOMAINS=megaplay.buzz,vidtube.site,vid-tube.site,vidplay.site,anipixcdn.co,norami.top,kryntal.top,akirax.buzz
|
|
|
|
# Referer sent to stream CDNs. They reject the site origin and an empty
|
|
# Referer; only the player origin passes. Change if the player domain moves.
|
|
# STREAM_PROXY_REFERER=https://megaplay.buzz/
|