Cobb
4f56893da6
Some checks failed
gitleaks / scan (push) Failing after 5s
Straw audit 2026-07-04. Three availability defects in the extraction core: - runtime.rs: cap the embedded QuickJS runtime (64 MiB mem / 2 MiB stack / 5s wall-clock interrupt) so a hostile or looping player.js can't hang the extraction thread or OOM the process. Previously Runtime::new() set no limits. - player_manager.rs: replace the never-cleared sticky-error flags with invalidate-on-failure. Any deobf/extract error now drops the cached player.js so the next call re-fetches fresh and retries, instead of one routine player.js rotation permanently wedging ALL extraction until app restart (clear_all_caches existed but was never called). - stream_extractor.rs: per-format graceful degradation. nsig-deobf failure falls back to the throttled original URL (YouTube still serves it, rate-limited); sig-cipher failure skips just that format. One bad format no longer aborts the whole video, and manifests/captions still populate. NPE parity. - Cargo.toml: release panic=unwind (inert as a straw dep; kept consistent for standalone builds/tests). 120 tests pass, clippy clean.
51 lines
1.5 KiB
TOML
51 lines
1.5 KiB
TOML
[package]
|
|
name = "strawcore-core"
|
|
version = "0.1.0"
|
|
edition = "2021"
|
|
license = "GPL-3.0-or-later"
|
|
authors = ["Sulkta"]
|
|
repository = "https://git.sulkta.com/Sulkta-OSS/strawcore"
|
|
description = "Rust port of NewPipeExtractor (YT-only). Plugs into Straw via UniFFI."
|
|
|
|
[lib]
|
|
# rlib only — strawcore-core is consumed as a Rust library, NOT loaded
|
|
# directly by Android. The Straw wrapper crate is the cdylib + the
|
|
# .so Android calls System.loadLibrary("strawcore") for. Emitting a
|
|
# cdylib here too just bloats jniLibs by ~300 KB per ABI.
|
|
crate-type = ["rlib"]
|
|
|
|
[dependencies]
|
|
reqwest = { version = "0.12", default-features = false, features = ["rustls-tls-webpki-roots", "blocking", "gzip"] }
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
thiserror = "1"
|
|
parking_lot = "0.12"
|
|
url = "2"
|
|
once_cell = "1"
|
|
regex = "1"
|
|
rquickjs = { version = "0.11", default-features = false }
|
|
ress = "0.12.0-alpha.1"
|
|
|
|
[dev-dependencies]
|
|
serde_json = "1"
|
|
|
|
[features]
|
|
default = []
|
|
# `online-tests` gates network-dependent integration tests. Enable with
|
|
# `cargo test --features online-tests` once an internet route is available.
|
|
online-tests = []
|
|
|
|
[profile.release]
|
|
strip = true
|
|
lto = "thin"
|
|
codegen-units = 1
|
|
# unwind: inert when built as a dependency of the Straw cdylib (that workspace's
|
|
# profile governs the shipped .so — the load-bearing setting lives in
|
|
# straw/rust/Cargo.toml), but kept consistent so a standalone release build/test
|
|
# of strawcore-core also unwinds instead of aborting on a core panic.
|
|
panic = "unwind"
|
|
opt-level = "z"
|
|
|
|
[profile.dev]
|
|
opt-level = 0
|
|
debug = 1
|