jirayu_sri/yt-dlp
1
0
Fork 0
mirror of https://github.com/yt-dlp/yt-dlp.git synced 2026-07-22 17:37:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Remove url, desktop and webloc from safe extensions

Browse Source 
See https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-c6mh-fpjc-4pr3

Authored by: Grub4K
This commit is contained in:
Simon Sawicki
2026-06-10 00:39:57 +02:00
parent 3ba1534fa3
commit e578e265f7
2 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
yt_dlp/utils/_utils.py
+6 -8
View File
@@ -2139,16 +2139,16 @@ def parse_duration(s):
(days, 86400), (hours, 3600), (mins, 60), (secs, 1), (ms, 1)))
def _change_extension(prepend, filename, ext, expected_real_ext=None):
def _change_extension(prepend, filename, ext, expected_real_ext=None, *, _allowed_exts=()):
name, real_ext = os.path.splitext(filename)
if not expected_real_ext or real_ext[1:] == expected_real_ext:
filename = name
if prepend and real_ext:
_UnsafeExtensionError.sanitize_extension(ext, prepend=True)
_UnsafeExtensionError.sanitize_extension(ext, prepend=True, _allowed_exts=_allowed_exts)
return f'{filename}.{ext}{real_ext}'
return f'{filename}.{_UnsafeExtensionError.sanitize_extension(ext)}'
return f'{filename}.{_UnsafeExtensionError.sanitize_extension(ext, _allowed_exts=_allowed_exts)}'
prepend_extension = functools.partial(_change_extension, True)
@@ -5211,12 +5211,9 @@ class _UnsafeExtensionError(Exception):
# others
*MEDIA_EXTENSIONS.manifests,
*MEDIA_EXTENSIONS.storyboards,
'desktop',
'ism',
'm3u',
'sbv',
'url',
'webloc',
])
def __init__(self, extension, /):
@@ -5224,7 +5221,7 @@ class _UnsafeExtensionError(Exception):
self.extension = extension
@classmethod
def sanitize_extension(cls, extension, /, *, prepend=False):
def sanitize_extension(cls, extension, /, *, prepend=False, _allowed_exts=()):
if extension is None:
return None
@@ -5235,7 +5232,8 @@ class _UnsafeExtensionError(Exception):
_, _, last = extension.rpartition('.')
if last == 'bin':
extension = last = 'unknown_video'
if last.lower() not in cls.ALLOWED_EXTENSIONS:
allowed = _allowed_exts or cls.ALLOWED_EXTENSIONS
if last.lower() not in allowed:
raise cls(extension)
return extension