{"action":"created","issue":{"url":"https://api.github.com/repos/zacyu/bilibili-helper/issues/170","repository_url":"https://api.github.com/repos/zacyu/bilibili-helper","labels_url":"https://api.github.com/repos/zacyu/bilibili-helper/issues/170/labels{/name}","comments_url":"https://api.github.com/repos/zacyu/bilibili-helper/issues/170/comments","events_url":"https://api.github.com/repos/zacyu/bilibili-helper/issues/170/events","html_url":"https://github.com/zacyu/bilibili-helper/issues/170","id":155161501,"number":170,"title":"建议：在线获取解析地址","user":{"login":"typcn","id":8022103,"avatar_url":"https://avatars.githubusercontent.com/u/8022103?v=3","gravatar_id":"","url":"https://api.github.com/users/typcn","html_url":"https://github.com/typcn","followers_url":"https://api.github.com/users/typcn/followers","following_url":"https://api.github.com/users/typcn/following{/other_user}","gists_url":"https://api.github.com/users/typcn/gists{/gist_id}","starred_url":"https://api.github.com/users/typcn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/typcn/subscriptions","organizations_url":"https://api.github.com/users/typcn/orgs","repos_url":"https://api.github.com/users/typcn/repos","events_url":"https://api.github.com/users/typcn/events{/privacy}","received_events_url":"https://api.github.com/users/typcn/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":17,"created_at":"2016-05-17T02:05:15Z","updated_at":"2016-05-17T10:08:54Z","closed_at":null,"body":"建议将播放地址 URL 的 sign 放到服务端，客户端发送 cid ，服务器将最终拼接好的 URL 返回客户端，客户端访问该 URL 进行解析，防止换 key 被封造成潜在的问题，由于服务器不会给 B 站服务器发送任何请求，不会影响 CDN 分配，也可以防止服务器 IP 被封等情况"},"comment":{"url":"https://api.github.com/repos/zacyu/bilibili-helper/issues/comments/219675070","html_url":"https://github.com/zacyu/bilibili-helper/issues/170#issuecomment-219675070","issue_url":"https://api.github.com/repos/zacyu/bilibili-helper/issues/170","id":219675070,"user":{"login":"typcn","id":8022103,"avatar_url":"https://avatars.githubusercontent.com/u/8022103?v=3","gravatar_id":"","url":"https://api.github.com/users/typcn","html_url":"https://github.com/typcn","followers_url":"https://api.github.com/users/typcn/followers","following_url":"https://api.github.com/users/typcn/following{/other_user}","gists_url":"https://api.github.com/users/typcn/gists{/gist_id}","starred_url":"https://api.github.com/users/typcn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/typcn/subscriptions","organizations_url":"https://api.github.com/users/typcn/orgs","repos_url":"https://api.github.com/users/typcn/repos","events_url":"https://api.github.com/users/typcn/events{/privacy}","received_events_url":"https://api.github.com/users/typcn/received_events","type":"User","site_admin":false},"created_at":"2016-05-17T10:08:54Z","updated_at":"2016-05-17T10:08:54Z","body":"当然会，他们手机客户端的 key 都是装在 lua 里面的，客户端每次启动都从服务器上下载新的解析代码，所以换 key 是非常容易的，而且他们还没对代码做校验，一个 http 劫持就能在用户的手机上任意执行代码"}}