Adding validation on start form, this will be moved soon

server/views/start.go

@@ -5,6 +5,7 @@ import (
 	"log"
 	"math"
 	"net/http"
+	"regexp"
 	"sort"
 	"strconv"
 	"strings"
@@ -27,31 +28,63 @@ func (v *Views) StartFunc(c echo.Context) error {
 			log.Println("Start POST called")
 		}
 
-		transporter := commonTransporter.Transporter{
-			Action: action.Start,
+		var response struct {
+			Unique string `json:"unique"`
+			Error  string `json:"error"`
 		}
 
+		var websiteOut string
+
 		streamSelector := c.FormValue("stream_selector")
+		if len(streamSelector) < 3 {
+			log.Printf("invalid stream selector value")
+			response.Error = fmt.Sprintf("invalid stream selector value")
+			return c.JSON(http.StatusOK, response)
+		}
 
-		fStart := commonTransporter.ForwarderStart{
-			StreamIn: streamSelector,
+		recordCheckboxRaw := c.FormValue("record_checkbox")
+		if recordCheckboxRaw != "" && recordCheckboxRaw != "on" {
+			log.Printf("invalid record checkbox value: %s", recordCheckboxRaw)
+			response.Error = fmt.Sprintf("invalid record checkbox value: %s", recordCheckboxRaw)
+			return c.JSON(http.StatusOK, response)
 		}
 
-		rStart := commonTransporter.RecorderStart{
-			StreamIn: streamSelector,
-			PathOut:  c.FormValue("save_path"),
+		recordCheckbox := recordCheckboxRaw == "on"
+
+		savePath := c.FormValue("save_path")
+		if len(savePath) == 0 && recordCheckbox {
+			log.Printf("invalid save path value")
+			response.Error = fmt.Sprintf("invalid save path value")
+			return c.JSON(http.StatusOK, response)
 		}
 
-		var response struct {
-			Unique string `json:"unique"`
-			Error  string `json:"error"`
+		if recordCheckbox && !strings.HasSuffix(savePath, ".mkv") {
+			log.Printf("the save path must end in \".mkv\"")
+			response.Error = fmt.Sprintf("the save path must end in \".mkv\"")
+			return c.JSON(http.StatusOK, response)
+		}
+
+		websiteCheckboxRaw := c.FormValue("website_stream")
+		if websiteCheckboxRaw != "" && websiteCheckboxRaw != "on" {
+			log.Printf("invalid website stream checkbox value: %s", recordCheckboxRaw)
+			response.Error = fmt.Sprintf("invalid website stream checkbox value: %s", recordCheckboxRaw)
+			return c.JSON(http.StatusOK, response)
 		}
 
-		if c.FormValue("website_stream") == "on" {
-			websiteStreamEndpoint := c.FormValue("website_stream_endpoint")
+		websiteCheckbox := websiteCheckboxRaw == "on"
+
+		websiteStreamEndpoint := c.FormValue("website_stream_endpoint")
+		if websiteCheckbox && !strings.Contains(websiteStreamEndpoint, "?pwd=") {
+			log.Printf("the website stream endpoint must contain \"?pwd=\"")
+			response.Error = fmt.Sprintf("the website stream endpoint must contain \"?pwd=\"")
+			return c.JSON(http.StatusOK, response)
+		}
+
+		if websiteCheckbox {
 			if v.websiteCheck(websiteStreamEndpoint) {
-				fStart.WebsiteOut = websiteStreamEndpoint
+				websiteOut = websiteStreamEndpoint
 			} else {
+				log.Printf("website key check has failed")
 				response.Error = "website key check has failed"
 				return c.JSON(http.StatusOK, response)
 			}
@@ -71,33 +104,75 @@ func (v *Views) StartFunc(c echo.Context) error {
 		}
 		sort.Ints(numbers)
 
-		unique, err := v.generateUnique()
+		streamServerRegex, err := regexp.Compile("^(rtmps?:\\/\\/)?" + // protocol
+			"((([a-z\\d]([a-z\\d-]*[a-z\\d])*)\\.)+[a-z]{2,}|" + // domain name
+			"((\\d{1,3}\\.){3}\\d{1,3}))" + // OR ip (v4) address
+			"(\\:\\d+)?(\\/[-a-z\\d%_.~+]*)*" + // port and path
+			"(\\?[;&a-z\\d%_.~+=-]*)?" + // query string
+			"(\\#[-a-z\\d_]*)?$") // fragment locator
 		if err != nil {
-			log.Printf("failed to get unique: %+v", err)
-			response.Error = fmt.Sprintf("failed to get unique: %+v", err)
+			log.Printf("failed to compile regex: %+v", err)
+			response.Error = fmt.Sprintf("failed to compile regex: %+v", err)
 			return c.JSON(http.StatusOK, response)
 		}
 
-		transporter.Unique = unique
-
 		var streams []string
 		for _, index := range numbers {
 			streamServer := c.FormValue("stream_server_" + strconv.Itoa(index))
+			if len(streamServer) == 0 {
+				log.Printf("invalid length of stream_server_%d", index)
+				response.Error = fmt.Sprintf("invalid length of stream_server_%d", index)
+				return c.JSON(http.StatusOK, response)
+			}
+			if !streamServerRegex.Match([]byte(streamServer)) {
+				log.Printf("invalid value of stream_server_%d: %+v", index, err)
+				response.Error = fmt.Sprintf("invalid value of stream_server_%d: %+v", index, err)
+				return c.JSON(http.StatusOK, response)
+			}
 			if streamServer[len(streamServer)-1] != '/' {
 				streamServer += "/"
 			}
-			streamServer += c.FormValue("stream_key_" + strconv.Itoa(index))
+			streamKey := c.FormValue("stream_key_" + strconv.Itoa(index))
+			if len(streamKey) == 0 {
+				log.Printf("invalid length of stream_key_%d", index)
+				response.Error = fmt.Sprintf("invalid length of stream_key_%d", index)
+				return c.JSON(http.StatusOK, response)
+			}
+			streamServer += streamKey
 			streams = append(streams, streamServer)
 		}
 
+		unique, err := v.generateUnique()
+		if err != nil {
+			log.Printf("failed to get unique: %+v", err)
+			response.Error = fmt.Sprintf("failed to get unique: %+v", err)
+			return c.JSON(http.StatusOK, response)
+		}
+
+		transporter := commonTransporter.Transporter{
+			Action: action.Start,
+		}
+
+		transporter.Unique = unique
+
+		rStart := commonTransporter.RecorderStart{
+			StreamIn: streamSelector,
+			PathOut:  savePath,
+		}
+
+		fStart := commonTransporter.ForwarderStart{
+			StreamIn:   streamSelector,
+			WebsiteOut: websiteOut,
+		}
+
 		fStart.Streams = streams
 
 		var wg sync.WaitGroup
 		wg.Add(2)
 		var errorMessages []string
 		go func() {
 			defer wg.Done()
-			if c.FormValue("record_checkbox") == "on" {
+			if recordCheckbox {
 				recorderTransporter := transporter
 				recorderTransporter.Payload = rStart
 				var wsResponse commonTransporter.ResponseTransporter