Clever Geek Handbook

How to hide trash in Spotify database and turn it into a quest

Dangerous hacker hides Spotify code with secret information
Dangerous hacker hides Spotify code with secret information

Introduction

One sleepless night, my friend and I talked about Spotify codes.

These are pictures that can be scanned by the application and go to the desired track / album / playlist. They were invented so that people could share music on social networks or offline.

Example. Such sadness is playing right now.
Example. Such sadness is playing right now.

We decided to figure out how Spotify encodes links in them.

How do codes work?

, «» , Spotify Codes, .

, - : https://scannables.scdn.co/uri/plain/jpeg/000000/white/640/spotify:track:5jxN9knH0vlfpN2Ft7a5xi

! , ID — .

, SVG. , .

The numbers in the height field are the heights of the bars
height —

, , , , Spotify, . .

Important data is highlighted in red

556205622371746371156, 58992959842 . . ? Spotify, .

: 58992959842 spotify:track:5jxN9knH0vlfpN2Ft7a5xi?

, - ID, ID - .

, - , : https://scannables.scdn.co/uri/plain/jpeg/000000/white/640/spotify:track:thisisaverylongidentifierwhichwoulddefinitelyoverflowthatnumericcode

. , / .

:

58992959842 goes to the server, and the track 5jxN9knH0vlfpN2Ft7a5xi returns
58992959842, 5jxN9knH0vlfpN2Ft7a5xi

: . ?

, ? ?

, , 11- ID.

The garbage picture from the example above

, ?

There will be a mistake

. , . , , :

Um, what?
, ?

. Spotify , , , , .

- - , : .

, , ID .

Android-, , , ID . , urlencode. , spotify:track:2ctvdKmETyOzPb2GiJJT53%253Fhi,habr!, :

Double bottom code

, , . Base64, URL .

Spotify ? , , . , .

Spotify? , , . .

? , . , , , . , API , , Spotify-, .

, Base64. - 42 . : .

, ID .

UPD: 15 , , Spotify .

The code generator no longer accepts garbage, now only IDs that match the format work.

This is very disappointing because I thought they didn't care and they would consider it a feature. Could go to Bug Bounty :(



More articles:


All Articles