harden deezer auth and lyrics tagging behavior

internal/download/downloader.go

@@ -77,15 +77,66 @@ func (d *Downloader) FileDeezerEncrypted(ctx context.Context, sourceURL, outputP
 	if resp.StatusCode != http.StatusOK {
 		return fmt.Errorf("download failed: status=%d", resp.StatusCode)
 	}
-	encrypted, err := io.ReadAll(resp.Body)
+	out, err := os.Create(outputPath)
 	if err != nil {
 		return err
 	}
-	plain, err := decryptDeezerBFCBCStripe(encrypted, trackID)
+	defer func() { _ = out.Close() }()
+
+	var bar *mpb.Bar
+	if d.ProgressEnabled() && resp.ContentLength > 0 {
+		d.barStarted.Store(1)
+		desc := shortenName(filepath.Base(outputPath), 54)
+		bar = d.progress.AddBar(
+			resp.ContentLength,
+			mpb.PrependDecorators(
+				decor.Name(desc+" ", decor.WC{W: 56, C: decor.DSyncWidth | decor.DindentRight}),
+				decor.Percentage(decor.WCSyncWidthR),
+			),
+			mpb.AppendDecorators(
+				decor.CountersKibiByte("% .1f / % .1f", decor.WCSyncWidthR),
+				decor.Name(" | ", decor.WCSyncWidth),
+				decor.AverageSpeed(decor.SizeB1024(0), "% .1f", decor.WCSyncWidthR),
+				decor.Name(" | ETA ", decor.WCSyncWidth),
+				decor.AverageETA(decor.ET_STYLE_GO, decor.WCSyncWidthR),
+			),
+			mpb.BarRemoveOnComplete(),
+		)
+	}
+
+	block, err := blowfish.NewCipher(deriveDeezerBlowfishKey(trackID))
 	if err != nil {
 		return err
 	}
-	return os.WriteFile(outputPath, plain, 0o644)
+	buf := make([]byte, deezerBFChunkSize)
+	dec := make([]byte, deezerBFChunkSize)
+	chunkIndex := 0
+	for {
+		n, readErr := io.ReadFull(resp.Body, buf)
+		if readErr == io.EOF {
+			break
+		}
+		if readErr != nil && readErr != io.ErrUnexpectedEOF {
+			return readErr
+		}
+		chunk := buf[:n]
+		if chunkIndex%3 == 0 && n == deezerBFChunkSize {
+			mode := cipher.NewCBCDecrypter(block, deezerBFIV)
+			mode.CryptBlocks(dec[:n], chunk)
+			chunk = dec[:n]
+		}
+		if _, err = out.Write(chunk); err != nil {
+			return err
+		}
+		if bar != nil {
+			bar.IncrBy(n)
+		}
+		chunkIndex++
+		if readErr == io.ErrUnexpectedEOF {
+			break
+		}
+	}
+	return nil
 }
 
 func (d *Downloader) file(ctx context.Context, sourceURL, outputPath string, allowProgress bool, includeVideo bool) error {

internal/download/downloader_test.go

@@ -84,3 +84,39 @@ func TestDecryptDeezerBFCBCStripe(t *testing.T) {
 		t.Fatalf("decrypted data mismatch")
 	}
 }
+
+func TestFileDeezerEncrypted(t *testing.T) {
+	trackID := "3135556"
+	plain := make([]byte, deezerBFChunkSize+777)
+	for i := range plain {
+		plain[i] = byte((i * 7) % 251)
+	}
+	enc := make([]byte, len(plain))
+	copy(enc, plain)
+
+	block, err := blowfish.NewCipher(deriveDeezerBlowfishKey(trackID))
+	if err != nil {
+		t.Fatalf("cipher error: %v", err)
+	}
+	cbc := cipher.NewCBCEncrypter(block, deezerBFIV)
+	cbc.CryptBlocks(enc[:deezerBFChunkSize], enc[:deezerBFChunkSize])
+
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = w.Write(enc)
+	}))
+	defer ts.Close()
+
+	d := NewWithOptions(true, false)
+	out := filepath.Join(t.TempDir(), "x", "a.flac")
+	if err = d.FileDeezerEncrypted(context.Background(), ts.URL, out, trackID); err != nil {
+		t.Fatalf("FileDeezerEncrypted() error = %v", err)
+	}
+
+	got, err := os.ReadFile(out)
+	if err != nil {
+		t.Fatalf("ReadFile() error = %v", err)
+	}
+	if string(got) != string(plain) {
+		t.Fatalf("decrypted file mismatch")
+	}
+}