PHP 播放器类库 - 安全解析视频地址，并提供字幕功能

<?php
include 'PlayerClass.php';
$ec = new PlayerClass();
$key = intval($_GET['key']);
$code = isset($_GET['code']) && !empty($_GET['code']) ? htmlspecialchars(urldecode(trim($_GET['code']))) : 'qw';;
$from = htmlspecialchars(urldecode(trim($_GET['from'])));
$url = htmlspecialchars(urldecode(trim($_GET['url'])));
$if = isset($_GET['if']) && !empty($_GET['if']) ? $_GET['if'] : '1';
$MacCmsBox = $ec->Start($key, $code, $from, $url);
?>


class PlayerClass {


    protected $sql_c = null;

    public function __construct()
    {
        include 'FileClass.php';
        include 'RedisClass.php';
        $this->sql_c = require('../../application/extra/zimu.php');
    }

    /**
     * 一切的起始
     * @param $key  '当前线路，默认0'
     * @param $code '播放器编码'
     * @param $from '播放组'
     * @param $url  '资源地址'
     * @return array
     */
    public function Start($key,$code,$from,$url):array
    {
        $config = require('../../application/extra/jx.php');
        $MacCmsBox = require('../../application/extra/'.$code.'.php');
        $jx_tart = [
            'id' => $MacCmsBox['row']['player'],
            'number'=>$MacCmsBox['number'],
            'dp' => ['tips'  =>  $config['tips'], 'code'  =>  304]
        ];

        //1.空参数
        if(empty($url)){$jx_tart['dp']['code'] = 301;return [
            'id' => $jx_tart['id'],
            'number' => $jx_tart['number'],
            'dp' => json_encode($jx_tart['dp'])
        ];}
        if(empty($key)){$key = 0;}

        //2.请求限制检查
        if($config['IP'] == '1'){
            if($this->limiting($config) == '304'){return [
                'id' => $jx_tart['id'],
                'number' => $jx_tart['number'],
                'dp' => json_encode($jx_tart['dp'])
            ];}
        }

        //3.进入解析处理
        if(substr($url,0,3) == 'EC_') {
            $url2 = substr($url,3);
            $url = $this->Decrypt(base64_decode($url2),$config['key'],$config['iv']);
        }
        $jx_data =  $this->JxTart(['key'  => $key, 'code' => $code, 'from' =>  $from, 'url'  => $url],$config);

        //4.字幕查询
        $mid = substr(md5($url),8,16);
        if($MacCmsBox['zm_off'] == 1){
            $dm_url = $this->sql_zm($mid);
            if(!empty($dm_url)){$MacCmsBox['zm_url'] = $dm_url;}
        }

        //5 移除不必要的配置
        if($MacCmsBox['random']){
            $MacCmsBox['gx']['pic'] = $this->Random_graph($MacCmsBox['random_img']);
        }
        unset($MacCmsBox['random_img']);
        unset($config['other']['danMu_vab']);
        $string = $this->string();$key = '2890'.$string.'tB959C';$MacCmsBox['uid']=$string;

        $jx_tart['dp'] = json_encode([
            'tips'   =>  $config['tips'],
            'lg'     =>  $config['lg'],
            'config' =>  $MacCmsBox,
            'code'   =>  $jx_data['code'],
            'type'   =>  $jx_data['type'],
            'html'   =>  $jx_data['api'],
            'url'    =>  $this->Encrypt($jx_data['url'],$key,'2F131BE91247866E'),
            'id1'    =>  $mid,
            'id2'    =>  $url,
        ]);

        return $jx_tart;
    }
}

根据提供的代码，没有明显的漏洞可以导致输出相对路径中的内容。代码中的包含文件都是固定路径，没有使用用户输入的数据作为文件路径。因此，无法利用该代码输出'../../application/extra/jx.php'中jx.php中的数组的内容。