Re:Show HN: I created an extension for direct streaming of v...
by runlevel1 on Saturday December 09, 2023 @01:34AM
(#38579243)
I just took a quick look at how this is doing its thing, and if I'm not mistaken -- and please correct me if I am -- isn't this sending sensitive information to your server?
When you activate this via the contextual menu item, it POSTs a query to app.native-video.com with just the video page's URL to get a list of header modification rules and a new URL to use them on. (Security concern there too.) The rules are temporarily injected using `declarativeNetRequest.updateDynamicRules` and then the browser is instructed to make a request to the new URL. It then sends the response (headers, body, and URL) it gets back to app.native-video.com. Rinse and repeat until it gets a direct URL to the video.
If I have that correct, the response data would contain boat loads of private information.
When you activate this via the contextual menu item, it POSTs a query to app.native-video.com with just the video page's URL to get a list of header modification rules and a new URL to use them on. (Security concern there too.) The rules are temporarily injected using `declarativeNetRequest.updateDynamicRules` and then the browser is instructed to make a request to the new URL. It then sends the response (headers, body, and URL) it gets back to app.native-video.com. Rinse and repeat until it gets a direct URL to the video.
If I have that correct, the response data would contain boat loads of private information.