How and why does this work?

[gedamial]

Hi. I'm just curious to understand how it's possible that Twitch's back-end sends the stream video data to a user not subscribed to a channel. If this extension is able to retrieve such data, it means it gets sent from Twitch to the local user even though they're not subscribed to the channel. Doesn't this look like too much of an amateur mistake to make?
Can someone explain?

Thanks.

[DWolf19]

Read the code

[gedamial]

Read the code

Has it ever occurred to you that maybe one could not have enough time or competence to look through code and they're asking what is supposed to be a "community" about the project?

[DWolf19]

Here we go again. Good luck with that attitude.

[gedamial]

Here we go again. Good luck with that attitude.

I wish you good luck with yours.

[DWolf19]

Duplicate of #87

[gedamial]

Oh I see a great number of kind people there as well. Lovely.

[elgatov]

The extension injects a script

TwitchNoSub/src/twitchnosub.js

Lines 1 to 8 in 5fe23ed

	function injectScript(src) {
	const s = document.createElement('script');
	s.src = chrome.runtime.getURL(src);
	s.onload = () => s.remove();
	(document.head || document.documentElement).append(s);
	}
	injectScript("src/app.js");

In the background, it checks which commit is the last and tries sets the cdnLink to it:

TwitchNoSub/src/background.js

Lines 62 to 72 in 5fe23ed

	(async () => {
	// Fetching current CDN link
	try {
	const response = await fetch("https://api.github.com/repos/besuper/TwitchNoSub/commits");
	const content = await response.json();
	var latestCommit = content[0].sha;
	console.log("Lastest commit sha: " + latestCommit);
	cdnLink = `https://cdn.jsdelivr.net/gh/besuper/TwitchNoSub@${latestCommit}/src/amazon-ivs-worker.min.js`;

If it fails for any reason, sets the variable to the default file in src:

TwitchNoSub/src/background.js

Lines 73 to 77 in 5fe23ed

	} catch (e) {
	console.log(e);
	cdnLink = `https://cdn.jsdelivr.net/gh/besuper/TwitchNoSub/src/amazon-ivs-worker.min.js`;
	}

Then executes app() and patches the original amazon-ivs-wasmworker.min-*.js with the one provided in cdnLink

TwitchNoSub/src/background.js

Lines 19 to 60 in 5fe23ed

	const app = () => {
	if (isChrome) {
	// declarativeNetRequest only available on chrome
	chrome.declarativeNetRequest.updateDynamicRules({
	addRules: [{
	'id': 1001,
	'priority': 1,
	'action': {
	'type': 'redirect',
	'redirect': { url: cdnLink }
	},
	'condition': { urlFilter: 'https://static.twitchcdn.net/assets/amazon-ivs-wasmworker.min-*.js' }
	}],
	removeRuleIds: [1001]
	});
	chrome.declarativeNetRequest.updateDynamicRules({
	addRules: [{
	'id': 1002,
	'priority': 1,
	'action': {
	'type': 'redirect',
	'redirect': { url: cdnLink }
	},
	'condition': { urlFilter: 'https://assets.twitch.tv/assets/amazon-ivs-wasmworker.min-*.js' }
	}],
	removeRuleIds: [1002]
	});
	} else {
	// Support firefox here
	browser.webRequest.onBeforeRequest.addListener(() => {
	return { redirectUrl: cdnLink };
	}, {
	urls: [
	"https://static.twitchcdn.net/assets/amazon-ivs-wasmworker.min-*.js",
	"https://assets.twitch.tv/assets/amazon-ivs-wasmworker.min-*.js"
	],
	types: ["main_frame", "script"]
	}, ["blocking"]);
	}
	};

The main function patches the appendChild function and checks if what is being appended is a script, if it is and its source contains player-core-variant-a it sets the variable isVariantA to true (I am not sure what this does)

TwitchNoSub/src/app.js

Lines 4 to 9 in 5fe23ed

	document.head.appendChild = function (element) {
	if (element.tagName === "SCRIPT") {
	if (element.src.includes("player-core-variant-a")) {
	isVariantA = true;
	}
	}

It also patches the worker to set new data, which is probably the function that let's you view a subscription-only video:

TwitchNoSub/src/app.js

Lines 16 to 34 in 5fe23ed

	window.Worker = class Worker extends oldWorker {
	constructor(twitchBlobUrl) {
	super(twitchBlobUrl);
	if (!isVariantA) {
	this.addEventListener("message", (event) => {
	const data = event.data;
	if (data.id == 1 && data.type == 1) {
	const newData = event.data;
	newData.arg = [data.arg];
	this.postMessage(newData);
	}
	});
	}
	}
	}

The people telling you to read the code in the comments have never committed to the code and are probably as clueless of how this works as you are. I would ignore them and move on.

Good luck.