Cobb
4f56893da6
Some checks failed
gitleaks / scan (push) Failing after 5s
Straw audit 2026-07-04. Three availability defects in the extraction core: - runtime.rs: cap the embedded QuickJS runtime (64 MiB mem / 2 MiB stack / 5s wall-clock interrupt) so a hostile or looping player.js can't hang the extraction thread or OOM the process. Previously Runtime::new() set no limits. - player_manager.rs: replace the never-cleared sticky-error flags with invalidate-on-failure. Any deobf/extract error now drops the cached player.js so the next call re-fetches fresh and retries, instead of one routine player.js rotation permanently wedging ALL extraction until app restart (clear_all_caches existed but was never called). - stream_extractor.rs: per-format graceful degradation. nsig-deobf failure falls back to the throttled original URL (YouTube still serves it, rate-limited); sig-cipher failure skips just that format. One bad format no longer aborts the whole video, and manifests/captions still populate. NPE parity. - Cargo.toml: release panic=unwind (inert as a straw dep; kept consistent for standalone builds/tests). 120 tests pass, clippy clean. |
||
|---|---|---|
| .. | ||
| downloader | ||
| stream | ||
| youtube | ||
| exceptions.rs | ||
| image.rs | ||
| lib.rs | ||
| localization.rs | ||
| newpipe.rs | ||