Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Replace http with https in DefaultPlayerUiController #860

Closed
ArcherEmiya05 opened this issue Jun 13, 2022 · 2 comments
Closed

Replace http with https in DefaultPlayerUiController #860

ArcherEmiya05 opened this issue Jun 13, 2022 · 2 comments

Comments

@ArcherEmiya05
Copy link

The library uses HTTP not HTTPS

image

@Serkali-sudo
Copy link
Contributor

That is not really a security issue because:

  1. That code is click listener of YouTube button that opens that video on YouTube app or web,And this button only exists on custom design and it doesn't matter because library is using webui as default.Heres original code : DefaultPlayerUiController.kt#97
  2. The library doesn't connect to that link to play video,It uses IFrame Player API which connects to https://www.youtube.com/iframe_api, Heres html page that player is loading : ayp_youtube_player.html
  3. Most of phone has YouTube app installed so even this button sends you to http link it will open on youtube app by default anyways but lets say that phone doesnt have youtube app or it is not default, even then youtube itself will automatically redirect https version of site.

@PierfrancescoSoffritti
Copy link
Owner

I agree this is not a security issue.

I'll rename the issue to keep it as a reminder to replace http with https in the next release.
Thanks @Serkali-sudo for taking a look :)

@PierfrancescoSoffritti PierfrancescoSoffritti changed the title Security issue with HTTP Replace http with https in DefaultPlayerUiController Sep 13, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants