remote/navidrome
1
0
Fork 0
mirror of https://github.com/navidrome/navidrome.git synced 2026-10-08 10:27:08 +02:00
Code Issues Projects Releases Packages Wiki Activity
navidrome/plugins/examples/coverartarchive-py/README.md
Deluan Quintão 1a8463f7de
 Merge commit from fork 
* fix(share): always assign the authenticated user as share owner

A share's UserID was taken from the request body and only defaulted when
empty, so any authenticated user could create a share attributed to
another user. For playlist shares the contents are resolved in the
owner's library-access context, turning the spoofed owner into an
access-escalation vector in multi-library setups.

Force the owner from the request context at both the service boundary
and the persistence layer, ignoring any client-supplied UserID.

* fix(plugins): block SSRF to private IPs resolved from hostnames

The HTTP host client only checked the literal host string, so a symbolic
hostname (or a trailing-dot "localhost.") resolving to a private/loopback
address bypassed the SSRF guard when a plugin declared no requiredHosts.

Enforce the check at dial time via net.Dialer.Control on the resolved IP,
which also covers redirect hops and DNS rebinding. When an explicit
requiredHosts allowlist is set, defer to it as the operator's trust decision.

* fix(plugins): gate private IPs on explicit IP/CIDR allowlist entries

Following review feedback: an allowlisted hostname authorizes the external
service, not whatever private IP it may resolve or rebind to. Enforce the
resolved-IP guard even when requiredHosts is set, permitting a private
address only when a literal IP or CIDR entry explicitly covers it. This
keeps "reach this external API" and "reach my internal network" as two
separate, explicit operator decisions.

* fix(plugins): treat unspecified addresses as private in the SSRF guard

Dialing 0.0.0.0 or :: reaches the local host, so they bypassed the
private/loopback check.

* fix(plugins): let a bare "*" allowlist reach private addresses

Plugins such as AudioMuse-AI declare requiredHosts ["*"] to reach a
user-configured service on the LAN, whose address the manifest cannot
know. Requiring a literal IP/CIDR entry broke them. Named hosts and
subdomain wildcards still cannot resolve to private addresses.

* refactor(plugins): simplify the SSRF-guarded HTTP client and release its pool

Build the client directly around the guarded transport instead of
replacing a throwaway one, fail closed on an unparseable dial address,
and close the per-plugin transport's idle connections when the plugin
unloads. Trim stale comments.

* fix(plugins): stop enabling extism's unguarded http_request host function

Passing requiredHosts as the extism manifest's AllowedHosts enabled
extism's own http_request (pdk.NewHTTPRequest), which only glob-matches
the hostname and follows redirects without re-checking, bypassing the
resolved-IP SSRF guard. Plugins must use host.HTTPSend.

* fix(plugins): move bundled Rust examples to the host HTTP service

Extism's built-in http_request is now disabled, so the webhook and
Discord examples switch to nd_pdk::host::http::send. Update the README
to say host.HTTPSend is the only supported way to make HTTP requests.

* fix(plugins): move the Python example to the host HTTP service

coverartarchive-py used extism's built-in Http.request, which is now
disabled. Call Navidrome's http_send host function instead. The plugin
can no longer run under the standalone extism CLI, so drop the CLI test
targets and instructions.
2026-09-12 13:38:08 -04:00

1.9 KiB
Raw Permalink Blame History

Cover Art Archive Plugin (Python)

A Python example plugin that fetches album cover images from the Cover Art Archive API using the MusicBrainz Release MBID.

Features

  • Implements the nd_get_album_images method of the MetadataAgent plugin interface
  • Returns front cover images for a given release MBID
  • Returns not found if no MBID is provided or no images are found
  • Demonstrates Python plugin development for Navidrome

Prerequisites

  • extism-py - Python PDK compiler 
    curl -Ls https://raw.githubusercontent.com/extism/python-pdk/main/install.sh | bash

Note: extism-py requires Binaryen (wasm-merge, wasm-opt) to be installed.

Building

From the plugins/examples directory:

make coverartarchive-py.ndp

Or directly:

extism-py plugin/__init__.py -o plugin.wasm
zip -j coverartarchive-py.ndp manifest.json plugin.wasm

Installation

  1. Copy coverartarchive-py.ndp to your Navidrome plugins folder

  2. Enable plugins in navidrome.toml:

    [Plugins]
Enabled = true
Folder = "/path/to/plugins"

  3. Add to your agents list:

    Agents = "coverartarchive-py,spotify,lastfm"

Testing

The plugin makes HTTP requests through Navidrome's http_send host function, so it only runs inside Navidrome (the extism CLI can't provide that function). Install the .ndp as described above, then open an album that has a MusicBrainz ID and check the Navidrome logs.

How It Works

  1. Album Image Request (nd_get_album_images): Receives album metadata including the MusicBrainz Release MBID.

  2. API Query: Fetches cover art metadata from https://coverartarchive.org/release/{mbid}.

  3. Response: Returns the front cover image URL if found.

API Reference