fix(OAuth): client identity matching

[patrickkfkan]

YouTube seems to have changed their Auth script which breaks OAuth#getClientIdentity(). The Client Identity regex used to match against the body of the script is bound to fail. The result is blocking of the entire process while the regex tries futilely to find a match.

This PR fixes the Client Identity matching part. From what I see, the request payload for device code also seems to have changed. Instead of model_name, it's now device_model:

So I have included this change in the PR too.

[patrickkfkan]

I've been thinking about the situation that occurred before the changes in this PR, where the entire node process locks up because regex keeps trying to find a match. Just wondering if anything can be done about it... worker threads + aborting on timeout comes to mind, but maintaining compatibility across browser, node.js ...is something I am not familiar with.

[absidue]

If it really is the regex itself that was causing the process to lock up, then moving it to worker threads is not solving the actual core problem, it's just working around the issue.
You need to rewrite the regex so that it doesn't suffer from catastrophic backtracking.
Moving it to worker threads is like building elaborate traps in your house to stop burglars, instead of just closing the front door that is unlocked and wide open.

[patrickkfkan]

I was just thinking of guarding against unforeseeable cases where catastrophic backtracking may occur, but you are right that the regex itself should be worked on instead.

So would you mind reviewing the modified regex to see if it is foolproof enough to handle future YT changes, as in not locking up the process when no match is possible? My knowledge of this is rather limited so would appreciate some help here..

[maciekr1234]

I can confirm indeed regex and or model_name was causing my app to stop responding.

[LuanRT]

I'll merge this PR right now and publish a new version as this is quite urgent. I plan on doing a small refactor in this portion of the code soon, so I can look into fixing the unsafe regular exp, but anyone feel free to contribute if you can.

Thanks Patrick!