From a2eb42ebb9d77098baf50c7de8737f4abfd69e9d Mon Sep 17 00:00:00 2001
From: Simon <simobilleter@gmail.com>
Date: Wed, 23 Aug 2023 21:22:09 +0700
Subject: [PATCH] validate subscribe url type, #299

---
 tubearchivist/api/views.py                       |  2 +-
 tubearchivist/home/src/download/subscriptions.py | 16 +++++++++++++---
 tubearchivist/home/tasks.py                      |  9 ++++++---
 tubearchivist/home/views.py                      |  4 ++--
 4 files changed, 22 insertions(+), 9 deletions(-)

diff --git a/tubearchivist/api/views.py b/tubearchivist/api/views.py
index 01b18c08..2cd0e111 100644
--- a/tubearchivist/api/views.py
+++ b/tubearchivist/api/views.py
@@ -331,7 +331,7 @@ class ChannelApiListView(ApiBaseView):
 
         pending = [i["channel_id"] for i in to_add if i["channel_subscribed"]]
         url_str = " ".join(pending)
-        subscribe_to.delay(url_str)
+        subscribe_to.delay(url_str, expected_type="channel")
 
         return Response(data)
 
diff --git a/tubearchivist/home/src/download/subscriptions.py b/tubearchivist/home/src/download/subscriptions.py
index 6325cb4f..aef62d6b 100644
--- a/tubearchivist/home/src/download/subscriptions.py
+++ b/tubearchivist/home/src/download/subscriptions.py
@@ -332,7 +332,7 @@ class SubscriptionHandler:
         self.task = task
         self.to_subscribe = False
 
-    def subscribe(self):
+    def subscribe(self, expected_type=False):
         """subscribe to url_str items"""
         if self.task:
             self.task.send_progress(["Processing form content."])
@@ -343,11 +343,16 @@ class SubscriptionHandler:
             if self.task:
                 self._notify(idx, item, total)
 
-            self.subscribe_type(item)
+            self.subscribe_type(item, expected_type=expected_type)
 
-    def subscribe_type(self, item):
+    def subscribe_type(self, item, expected_type):
         """process single item"""
         if item["type"] == "playlist":
+            if expected_type and expected_type != "playlist":
+                raise TypeError(
+                    f"expected {expected_type} url but got {item.get('type')}"
+                )
+
             PlaylistSubscription().process_url_str([item])
             return
 
@@ -360,6 +365,11 @@ class SubscriptionHandler:
         else:
             raise ValueError("failed to subscribe to: " + item["url"])
 
+        if expected_type and expected_type != "channel":
+            raise TypeError(
+                f"expected {expected_type} url but got {item.get('type')}"
+            )
+
         self._subscribe(channel_id)
 
     def _subscribe(self, channel_id):
diff --git a/tubearchivist/home/tasks.py b/tubearchivist/home/tasks.py
index 5ce1d627..a2c4cdbf 100644
--- a/tubearchivist/home/tasks.py
+++ b/tubearchivist/home/tasks.py
@@ -343,9 +343,12 @@ def re_sync_thumbs(self):
 
 
 @shared_task(bind=True, name="subscribe_to", base=BaseTask)
-def subscribe_to(self, url_str):
-    """take a list of urls to subscribe to"""
-    SubscriptionHandler(url_str, task=self).subscribe()
+def subscribe_to(self, url_str: str, expected_type: str | bool = False):
+    """
+    take a list of urls to subscribe to
+    optionally validate expected_type channel / playlist
+    """
+    SubscriptionHandler(url_str, task=self).subscribe(expected_type)
 
 
 @shared_task(bind=True, name="index_playlists", base=BaseTask)
diff --git a/tubearchivist/home/views.py b/tubearchivist/home/views.py
index ef880a74..507c9336 100644
--- a/tubearchivist/home/views.py
+++ b/tubearchivist/home/views.py
@@ -736,7 +736,7 @@ class ChannelView(ArchivistResultsView):
         if subscribe_form.is_valid():
             url_str = request.POST.get("subscribe")
             print(url_str)
-            subscribe_to.delay(url_str)
+            subscribe_to.delay(url_str, expected_type="channel")
 
         sleep(1)
         return redirect("channel", permanent=True)
@@ -879,7 +879,7 @@ class PlaylistView(ArchivistResultsView):
         if subscribe_form.is_valid():
             url_str = request.POST.get("subscribe")
             print(url_str)
-            subscribe_to.delay(url_str)
+            subscribe_to.delay(url_str, expected_type="playlist")
 
         sleep(1)
         return redirect("playlist")