Enforce UTF-8 encoding for input bytes

srt.go

@@ -7,6 +7,7 @@ import (
 	"strconv"
 	"strings"
 	"time"
+	"unicode/utf8"
 )
 
 // Constants
@@ -43,6 +44,10 @@ func ReadFromSRT(i io.Reader) (o *Subtitles, err error) {
 		// Fetch line
 		line = strings.TrimSpace(scanner.Text())
 		lineNum++
+		if !utf8.ValidString(line) {
+			err = fmt.Errorf("astisub: line %d is not valid utf-8", lineNum)
+			return
+		}
 
 		// Remove BOM header
 		if lineNum == 1 {

srt_test.go

@@ -3,6 +3,7 @@ package astisub_test
 import (
 	"bytes"
 	"io/ioutil"
+	"os"
 	"testing"
 
 	"github.com/asticode/go-astisub"
@@ -46,3 +47,16 @@ func TestSRTMissingSequence(t *testing.T) {
 	assert.NoError(t, err)
 	assert.Equal(t, string(c), w.String())
 }
+
+func TestNonUTF8SRT(t *testing.T) {
+	_, err := astisub.OpenFile("./testdata/example-in-non-utf8.srt")
+	assert.Error(t, err)
+}
+
+func BenchmarkOpenSRT(b *testing.B) {
+	f, _ := os.Open("./testdata/example-in.srt")
+	defer f.Close()
+	for i := 0; i < b.N; i++ {
+		astisub.ReadFromSRT(f)
+	}
+}

webvtt.go

@@ -11,6 +11,7 @@ import (
 	"strconv"
 	"strings"
 	"time"
+	"unicode/utf8"
 
 	"golang.org/x/net/html"
 )
@@ -128,6 +129,10 @@ func ReadFromWebVTT(i io.Reader) (o *Subtitles, err error) {
 		lineNum++
 		line = scanner.Text()
 		line = strings.TrimPrefix(line, string(BytesBOM))
+		if !utf8.ValidString(line) {
+			err = fmt.Errorf("astisub: line %d is not valid utf-8", lineNum)
+			return
+		}
 		if fs := strings.Fields(line); len(fs) > 0 && fs[0] == "WEBVTT" {
 			break
 		}
@@ -144,6 +149,10 @@ func ReadFromWebVTT(i io.Reader) (o *Subtitles, err error) {
 		// Fetch line
 		line = strings.TrimSpace(scanner.Text())
 		lineNum++
+		if !utf8.ValidString(line) {
+			err = fmt.Errorf("astisub: line %d is not valid utf-8", lineNum)
+			return
+		}
 
 		switch {
 		// Comment

webvtt_test.go

@@ -3,6 +3,7 @@ package astisub_test
 import (
 	"bytes"
 	"io/ioutil"
+	"os"
 	"strings"
 	"testing"
 	"time"
@@ -48,6 +49,11 @@ func TestBroken1WebVTT(t *testing.T) {
 	assert.Nil(t, err)
 }
 
+func TestNonUTF8WebVTT(t *testing.T) {
+	_, err := astisub.OpenFile("./testdata/example-in-non-utf8.vtt")
+	assert.Error(t, err)
+}
+
 func TestWebVTTWithVoiceName(t *testing.T) {
 	testData := `WEBVTT
 
@@ -227,3 +233,11 @@ func TestWebVTTTags(t *testing.T) {
 Text with a <00:06:30.000>timestamp in the middle
 `, b.String())
 }
+
+func BenchmarkOpenWebVTT(b *testing.B) {
+	f, _ := os.Open("./testdata/example-in.vtt")
+	defer f.Close()
+	for i := 0; i < b.N; i++ {
+		astisub.ReadFromWebVTT(f)
+	}
+}