From bdcdf9b1f5430760be605a7a5e84440e324de7b5 Mon Sep 17 00:00:00 2001
From: toasted-nutbread <toasted-nutbread@users.noreply.github.com>
Date: Sun, 2 Aug 2020 18:58:19 -0400
Subject: Strip request origin (#710)

* Add web request permissions

* Create fetch wrapper that anonymizes the request

* Fix Firefox not supporting 'extraHeaders' option
---
 ext/mixed/js/audio-system.js | 33 +++++++++++++++++----------------
 1 file changed, 17 insertions(+), 16 deletions(-)

(limited to 'ext/mixed')

diff --git a/ext/mixed/js/audio-system.js b/ext/mixed/js/audio-system.js
index fdfb0b10..07e1a79b 100644
--- a/ext/mixed/js/audio-system.js
+++ b/ext/mixed/js/audio-system.js
@@ -66,10 +66,11 @@ class TextToSpeechAudio {
 }
 
 class AudioSystem {
-    constructor({audioUriBuilder, useCache}) {
+    constructor({audioUriBuilder, requestBuilder=null, useCache}) {
         this._cache = useCache ? new Map() : null;
         this._cacheSizeMaximum = 32;
         this._audioUriBuilder = audioUriBuilder;
+        this._requestBuilder = requestBuilder;
 
         if (typeof speechSynthesis !== 'undefined') {
             // speechSynthesis.getVoices() will not be populated unless some API call is made.
@@ -169,22 +170,22 @@ class AudioSystem {
         });
     }
 
-    _createAudioBinaryFromUrl(url) {
-        return new Promise((resolve, reject) => {
-            const xhr = new XMLHttpRequest();
-            xhr.responseType = 'arraybuffer';
-            xhr.addEventListener('load', async () => {
-                const arrayBuffer = xhr.response;
-                if (!await this._isAudioBinaryValid(arrayBuffer)) {
-                    reject(new Error('Could not retrieve audio'));
-                } else {
-                    resolve(arrayBuffer);
-                }
-            });
-            xhr.addEventListener('error', () => reject(new Error('Failed to connect')));
-            xhr.open('GET', url);
-            xhr.send();
+    async _createAudioBinaryFromUrl(url) {
+        const response = await this._requestBuilder.fetchAnonymous(url, {
+            method: 'GET',
+            mode: 'cors',
+            cache: 'default',
+            credentials: 'omit',
+            redirect: 'follow',
+            referrerPolicy: 'no-referrer'
         });
+        const arrayBuffer = await response.arrayBuffer();
+
+        if (!await this._isAudioBinaryValid(arrayBuffer)) {
+            throw new Error('Could not retrieve audio');
+        }
+
+        return arrayBuffer;
     }
 
     _isAudioValid(audio) {
-- 
cgit v1.2.3