updated to modern encryption for spoofing

anify-backend/src/env.ts

@@ -12,7 +12,7 @@ export const env = {
     USE_MIXDROP: process.env.USE_MIXDROP === "true" || false,
     MIXDROP_EMAIL: process.env.MIXDROP_EMAIL,
     MIXDROP_KEY: process.env.MIXDROP_KEY,
-    SECRET_KEY: process.env.SECRET_KEY ?? "anify",
+    SECRET_KEY: process.env.SECRET_KEY ?? "anifydobesupercoolbrodudeawesome",// MUST BE 32 CHARACTERS
     TEXT_TO_INJECT: process.env.TEXT_TO_INJECT ?? "Provided by anify.tv",
     DISTANCE_FROM_INJECTED_TEXT_SECONDS: Number(process.env.DISTANCE_FROM_INJECTED_TEXT ?? 300),
     DURATION_FOR_INJECTED_TEXT_SECONDS: Number(process.env.DISTANCE_FROM_INJECTED_TEXT ?? 5),

anify-backend/src/server/impl/sources.ts

@@ -4,6 +4,7 @@ import { env } from "../../env";
 import { StreamingServers, SubType } from "../../types/enums";
 import { Source } from "../../types/types";
 import queues from "../../worker";
+import { AES } from "../lib/Aes";
 import { createResponse } from "../lib/response";
 import crypto from "crypto";
 export const handler = async (req: Request): Promise<Response> => {
@@ -53,7 +54,7 @@ export const handler = async (req: Request): Promise<Response> => {
             const cachedData = JSON.parse(cached) as Source;
             if (env.USE_SUBTITLE_SPOOFING) {
                 cachedData?.subtitles?.forEach((sub) => {
-                    if (sub.lang != "Thumbnails" && sub.url.endsWith(".vtt") && !sub.url.startsWith(env.API_URL)) sub.url = env.API_URL + "/subtitles/" + encodeUrl(sub.url) + ".vtt";
+                    if (sub.lang != "Thumbnails" && sub.url.endsWith(".vtt") && !sub.url.startsWith(env.API_URL)) sub.url = env.API_URL + "/subtitles/" + AES.Encrypt(sub.url,env.SECRET_KEY) + ".vtt";
                 });
             }
             return createResponse(cached);
@@ -62,7 +63,7 @@ export const handler = async (req: Request): Promise<Response> => {
         const data = await content.fetchSources(providerId, watchId, subType as SubType, server as StreamingServers);
         if (env.USE_SUBTITLE_SPOOFING) {
             data?.subtitles?.forEach((sub) => {
-                if (sub.lang != "Thumbnails" && sub.url.endsWith(".vtt")) sub.url = env.API_URL + "/subtitles/" + encodeUrl(sub.url) + ".vtt";
+                if (sub.lang != "Thumbnails" && sub.url.endsWith(".vtt")) sub.url = env.API_URL + "/subtitles/" + AES.Encrypt(sub.url,env.SECRET_KEY) + ".vtt";
             });
         }
 
@@ -95,10 +96,3 @@ type Body = {
 };
 
 export default route;
-
-function encodeUrl(url: string) {
-    const cipher = crypto.createCipher("aes-256-cbc", env.SECRET_KEY);
-    let encrypted = cipher.update(url, "utf-8", "hex");
-    encrypted += cipher.final("hex");
-    return encrypted;
-}

anify-backend/src/server/impl/subtitles.ts

@@ -4,6 +4,7 @@ import crypto from "crypto";
 import { parse } from "@plussub/srt-vtt-parser";
 import { Entry, ParsedResult } from "@plussub/srt-vtt-parser/dist/src/types";
 import NodeCache from "node-cache";
+import { AES } from "../lib/Aes";
 
 const subtitleCache = new NodeCache({ stdTTL: env.SUBTITLES_CACHE_TIME });
 export const handler = async (req: Request): Promise<Response> => {
@@ -22,7 +23,7 @@ export const handler = async (req: Request): Promise<Response> => {
         }
 
         encryptedUrl = encryptedUrl.replace(".vtt", "");
-        const decodedUrl = decodeUrl(encryptedUrl);
+        const decodedUrl = AES.Decrypt(encryptedUrl, env.SECRET_KEY);
 
         if (!decodedUrl) {
             return createResponse(JSON.stringify({ error: "Invalid url provided." }), 400);

anify-backend/src/server/lib/Aes.ts

@@ -0,0 +1,28 @@
+import crypto from "crypto";
+const IV_SIZE = 16;
+export class AES
+{
+    static Encrypt(plainText:string, keyString:string)
+    {
+        const iv = crypto.randomBytes(IV_SIZE);
+        const cipher = crypto.createCipheriv("aes-256-cbc", keyString, iv);
+        let cipherText = cipher.update(Buffer.from(plainText, "utf8"));
+        cipherText = Buffer.concat([cipherText, cipher.final()]);
+        const combinedData = Buffer.concat([iv, cipherText]);
+        const combinedString = combinedData.toString("base64");
+        return combinedString;
+    }
+
+    static Decrypt(combinedString:string, keyString:string)
+    {
+        const combinedData = Buffer.from(combinedString, "base64");
+        const iv = Buffer.alloc(IV_SIZE);
+        const cipherText = Buffer.alloc(combinedData.length - iv.length);
+        combinedData.copy(iv, 0, 0, iv.length);
+        combinedData.copy(cipherText, 0, iv.length);
+        const decipher = crypto.createDecipheriv("aes-256-cbc", keyString, iv);
+        let plainText = decipher.update(cipherText);
+        plainText = Buffer.concat([plainText, decipher.final()]);
+        return plainText.toString("utf8");
+    }
+}