patrickkfkan / bandcamp-fetch Goto Github PK

Hi when I go to install your package npm notifies of critical security vulnerabilities from safe-eval package. Checking that repo it seems the code is no longer being maintained. Can you remove this dependency?

safe-eval  *
Severity: critical
Sandbox Breakout / Arbitrary Code Execution in safe-eval - https://github.com/advisories/GHSA-9pcf-h8q9-63f6
Sandbox Breakout / Arbitrary Code Execution in safe-eval - https://github.com/advisories/GHSA-hrpq-r399-whgw
safe-eval vulnerable to Prototype Pollution - https://github.com/advisories/GHSA-33vh-7x8q-mg35

Hi Patrick,

Wanted to say thanks for your api. I'm currently using it in to scrape for genre-subgenre combinations. Later, I think i'll add possibilities to stream random albums from tag combinations.

Thanks !
Helder

I've found that when fetching Bandcamp Track information using BandcampFetch().track.getInfo(), track duration information is not returned. Setting includeRawData: true allows us to see that the duration property is not called duration_secs but rather duration, and can be found under raw.basic.duration. This duration property is not a number representing the duration in seconds but rather a string that tells how long the song is in hours, minutes, and seconds: "P00H05M19S"

Code responsible for parsing the duration from TrackInfo:

I believe there may have been a change at some point in the Bandcamp API that is causing this issue. Or possibly that some tracks return the usual duration_secs info, but other tracks return this weird duration string instead.

I have prepared a RunKit playground for you if you'd like to run some sample code that showcases this odd behavior. Also included is a workaround method that I've written to fetch the duration for the time being.
https://runkit.com/bonfire/bandcamp-fetch-duration

Thank you!

I've tried the method as described here to get the session cookie. At the moment I don't get HQ urls back.

I've tried both Chrome & Firefox, made sure I was logged out before starting.
I also tried different albums because I thought some just might not have the HQ property at all.

Any Idea?

PS: the session cookie value looks different in Chrome vs Firefox, both none of both work for me.

Cheers!