services

services_vulnerable/tiktak/video/preview.go

@@ -0,0 +1,62 @@
+package video
+
+import (
+	"context"
+	"fmt"
+	"github.com/disintegration/imaging"
+	"image"
+	"image/png"
+	"os"
+	"os/exec"
+	"strings"
+	"time"
+)
+
+var (
+	ProcessingDeadline = 2 * time.Second
+	semaphore          = make(chan struct{}, 75)
+)
+
+func generatePreview(ctx context.Context, inp string, out string) error {
+	cmd := exec.CommandContext(ctx, "ffmpeg", "-y", "-i", inp, "-vframes", "1", out)
+	s := strings.Builder{}
+	cmd.Stdout = &s
+	cmd.Stderr = &s
+	err := cmd.Run()
+	if err != nil {
+		fmt.Println(s.String())
+	}
+	return err
+}
+
+func GeneratePreview(ctx context.Context, inp string, out string) error {
+	select {
+	case semaphore <- struct{}{}:
+		ctx, cancel := context.WithTimeout(ctx, ProcessingDeadline)
+		defer func() {
+			cancel()
+			<-semaphore
+		}()
+		return generatePreview(ctx, inp, out)
+	case <-ctx.Done():
+		return ctx.Err()
+	}
+}
+
+func Blur(inp string, out string) error {
+	f, err := os.Open(inp)
+	if err != nil {
+		return err
+	}
+	img, _, err := image.Decode(f)
+	if err != nil {
+		return err
+	}
+	outimg := imaging.Blur(img, 5)
+	outfile, err := os.Create(out)
+	if err != nil {
+		return err
+	}
+	defer outfile.Close()
+	return png.Encode(outfile, outimg)
+}

services_vulnerable/tiktak/video/storage.go

@@ -0,0 +1,63 @@
+package video
+
+import (
+	"errors"
+	"github.com/google/uuid"
+	"io"
+	"mime/multipart"
+	"net/http"
+	"os"
+	"path/filepath"
+)
+
+const (
+	MaxSize = 5 << 20
+)
+
+var (
+	validationError = errors.New("unsupported video format. should be webm")
+)
+
+type Storage struct {
+	Directory string
+}
+
+func (p *Storage) validateWebm(h io.Reader) bool {
+	header := make([]byte, 512)
+	_, err := h.Read(header)
+	if err != nil {
+		return false
+	}
+	if http.DetectContentType(header) == "video/webm" {
+		return true
+	}
+	return false
+}
+
+func (p *Storage) Store(src multipart.File) (string, error) {
+	if !p.validateWebm(src) {
+		return "", validationError
+	}
+	_, err := src.Seek(0, io.SeekStart)
+	if err != nil {
+		return "", err
+	}
+
+	vid := p.generateId()
+	dst, err := os.Create(p.Path(vid))
+	if err != nil {
+		return "", err
+	}
+	defer dst.Close()
+
+	_, err = io.Copy(dst, src)
+	return vid, err
+}
+
+func (p *Storage) Path(vid string) string {
+	return filepath.Join(p.Directory, vid) + ".webm"
+}
+
+func (p *Storage) generateId() string {
+	return uuid.New().String()
+}

services_vulnerable/tiktak/video/vtt.go

@@ -0,0 +1,65 @@
+package video
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"math"
+	"os/exec"
+	"strings"
+)
+
+func getDuration(ctx context.Context, inp string) (res float64, err error) {
+
+	args := []string{"-v", "error", "-show_entries", "format=duration", "-of", "default=noprint_wrappers=1:nokey=1", inp}
+
+	cmd := exec.CommandContext(ctx, "ffprobe", args...)
+
+	out, err := cmd.Output()
+
+	if err != nil {
+		return -1, err
+	}
+
+	_, err = fmt.Fscan(bytes.NewReader(out), &res)
+	return
+}
+
+func GetDuration(ctx context.Context, inp string) (res float64, err error) {
+	select {
+	case semaphore <- struct{}{}:
+		ctx, cancel := context.WithTimeout(ctx, ProcessingDeadline)
+		defer func() {
+			cancel()
+			<-semaphore
+		}()
+		return getDuration(ctx, inp)
+	case <-ctx.Done():
+		return 0, ctx.Err()
+	}
+}
+
+func GenerateVtt(ctx context.Context, inp string, s string) ([]string, error) {
+	duration, err := GetDuration(ctx, inp)
+	if err != nil {
+		return nil, err
+	}
+	lines := strings.Split(s, "\n")
+	vttLines := make([]string, len(lines))
+	delta := duration / float64(len(lines))
+	for i := range vttLines {
+		s1 := generateStamp(float64(i) * delta)
+		s2 := generateStamp(float64(i+1) * delta)
+		vttLines[i] = fmt.Sprintf("%s --> %s\n", s1, s2)
+		vttLines[i] += lines[i] + "\n"
+	}
+	return vttLines, err
+
+}
+
+func generateStamp(p float64) string {
+	m := math.Floor(p / 60)
+	s := math.Mod(p, 60.0)
+	return fmt.Sprintf("%02.0f:%06.3f", m, s)
+
+}