From af73f9daefca1439f1e008a56c3e3e4d2b95db4a Mon Sep 17 00:00:00 2001
From: As9xm <197338912+As9xm@users.noreply.github.com>
Date: Tue, 8 Sep 2026 00:23:33 +0300
Subject: [PATCH] fix(proxy): derive proxy base from request url to prevent
 host header injection

---
 src/app/api/proxy/m3u8/route.ts | 16 ++--------------
 1 file changed, 2 insertions(+), 14 deletions(-)

diff --git a/src/app/api/proxy/m3u8/route.ts b/src/app/api/proxy/m3u8/route.ts
index 007622700c..9e39563683 100644
--- a/src/app/api/proxy/m3u8/route.ts
+++ b/src/app/api/proxy/m3u8/route.ts
@@ -95,20 +95,8 @@ export async function GET(request: Request) {
 }
 
 function rewriteM3U8Content(content: string, baseUrl: string, req: Request, allowCORS: boolean) {
-  // 从 referer 头提取协议信息
-  const referer = req.headers.get('referer');
-  let protocol = 'http';
-  if (referer) {
-    try {
-      const refererUrl = new URL(referer);
-      protocol = refererUrl.protocol.replace(':', '');
-    } catch (error) {
-      // ignore
-    }
-  }
-
-  const host = req.headers.get('host');
-  const proxyBase = `${protocol}://${host}/api/proxy`;
+  const requestUrl = new URL(req.url);
+  const proxyBase = `${requestUrl.protocol}//${requestUrl.host}/api/proxy`;
 
   const lines = content.split('\n');
   const rewrittenLines: string[] = [];