843330 - Video app is vulnerable to API URL parameter injection attack

Status: RESOLVED INVALID

(Firefox OS Graveyard :: Gaia::Video, defect)

Description

[Stefan Arentz | :st3fan | ⏰ EST | he/him]

In gaia/apps/video/youtube.js this is done for incoming YouTube URLs:

  var videoId = url.slice(15, url.indexOf('?'));

And then blindly appends the videoId to the API URL using string concatenation.

This is very easy to manipulate to inject extra parameters to the API:

  url = "vnd.youtube:///VIDEOID&extraparam1=foo&redirecttoevilsite=yes?"
  videoId = url.slice(15, url.indexOf('?'));
  query = 'http://www.youtube.com/get_video_info?&video_id=' + videoId;

query is now:

  http://www.youtube.com/get_video_info?&video_id=VIDEOID&extraparam1=foo&redirecttoevilsite=yes

This can be improved with a simple regex or better splitting of the incoming URL.

Comment 1

[John Hu [:johnhu][:johu][:醬糊小弟]]

YouTube is no long played inside of video app.