jirayu_sri/yt-dlp
1
0
Fork 0
mirror of https://github.com/yt-dlp/yt-dlp.git synced 2026-07-22 09:27:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

[pp/exec] Restrict --exec template usage to safe conversions (#16883)

Browse Source 
Authored by: bashonly
This commit is contained in:
bashonly
2026-06-06 21:24:53 +00:00
committed by GitHub
parent 7aac95eae6
commit 5faffa999f
7 changed files with 103 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/test_postprocessors.py
+49 -1
View File
@@ -11,7 +11,10 @@ sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
import subprocess
from yt_dlp import YoutubeDL
from yt_dlp.utils import shell_quote
from yt_dlp.utils import (
UnsafeExecExpansionError,
shell_quote,
)
from yt_dlp.postprocessor import (
ExecPP,
FFmpegThumbnailsConvertorPP,
@@ -91,6 +94,51 @@ class TestExec(unittest.TestCase):
self.assertEqual(pp.parse_cmd('echo {}', info), cmd)
self.assertEqual(pp.parse_cmd('echo %(filepath)q', info), cmd)
def test_unsafe_exec_expansion(self):
# Test unsafe placeholder
ydl = YoutubeDL({'outtmpl_na_placeholder': ';'})
self.assertRaisesRegex(UnsafeExecExpansionError, r'Unsafe placeholder', ExecPP, ydl, 'echo %(title)q')
ydl = YoutubeDL()
# Test unsafe commands
self.assertRaisesRegex(UnsafeExecExpansionError, r'Unsafe conversion', ExecPP, ydl, 'echo "%(title)s"')
self.assertRaisesRegex(UnsafeExecExpansionError, r'Unsafe conversion', ExecPP, ydl, 'echo "%(title).100B"')
self.assertRaisesRegex(UnsafeExecExpansionError, r'Unsafe conversion', ExecPP, ydl, 'echo "%(title)S"')
self.assertRaisesRegex(UnsafeExecExpansionError, r'Unsafe conversion', ExecPP, ydl, 'echo "%(title)#j"')
self.assertRaisesRegex(UnsafeExecExpansionError, r'Unsafe default', ExecPP, ydl, 'echo %(title|;)q')
# Test safe commands
self.assertIsInstance(
ExecPP(ydl, [
'echo',
'echo {}',
'echo %(title)q',
'echo %(title|NA)q',
'echo %(title)#q',
'echo %(view_count)i',
'echo %(view_count)02d',
'echo %(aspect_ratio)f',
'echo %(aspect_ratio).2f',
]),
ExecPP)
# Test compat opt
ydl = YoutubeDL({
'outtmpl_na_placeholder': ';',
'compat_opts': {'allow-unsafe-exec-expansion'},
})
self.assertIsInstance(
ExecPP(ydl, [
'echo "%(title)s"',
'echo %(title)q',
'echo "%(title).100B"',
'echo "%(title)S"',
'echo "%(title)#S"',
'echo "%(title)j"',
'echo "%(title)#j"',
'echo %(title|;)q',
]),
ExecPP)
class TestModifyChaptersPP(unittest.TestCase):
def setUp(self):