Commit Graph

17 Commits (ff07792676f404ffff6ee61b5638c9dc1a33a37a)

Author SHA1 Message Date
Simon Sawicki ff07792676
[core] Prevent RCE when using `--exec` with `%q` (CVE-2024-22423)
The shell escape function now properly escapes `%`, `\\` and `\n`. `utils.Popen` as well as `%q` output template expansion have been patched accordingly.

Prior to this fix using `--exec` together with `%q` when on Windows could cause remote code to execute. See https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-hjq6-52gw-2g7p for more details.

Authored by: Grub4K
2 months ago
Simon Sawicki de015e9307
[core] Prevent RCE when using `--exec` with `%q` (CVE-2023-40581)
The shell escape function is now using `""` instead of `\"`. `utils.Popen` has been patched to properly quote commands.

Prior to this fix using `--exec` together with `%q` when on Windows could cause remote code to execute. See https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-42h4-v29r-42qg for reference.

Authored by: Grub4K
8 months ago
pukkandan a250b24733
[compat] Ensure submodules are imported correctly
Closes #7663
10 months ago
coletdjnz 227bf1a33b
[networking] Rewrite architecture (#2861)
New networking interface consists of a `RequestDirector` that directs
each `Request` to appropriate `RequestHandler` and returns the
`Response` or raises `RequestError`. The handlers define adapters to
transform its internal Request/Response/Errors to our interfaces.

User-facing changes:
- Fix issues with per request proxies on redirects for urllib
- Support for `ALL_PROXY` environment variable for proxy setting
- Support for `socks5h` proxy
   - Closes https://github.com/yt-dlp/yt-dlp/issues/6325, https://github.com/ytdl-org/youtube-dl/issues/22618, https://github.com/ytdl-org/youtube-dl/pull/28093
- Raise error when using `https` proxy instead of silently converting it to `http`

Authored by: coletdjnz
11 months ago
pukkandan acb1042a9f
[devscripts] Provide pyinstaller hooks
Closes #6185
1 year ago
pukkandan 754c84e2e4
Support module level `__bool__` and `property` 1 year ago
Alex Karabanov 0d2a0ecac3
[extractor/listennotes] Add extractor (#5310)
Closes #5262
Authored by: lksj, pukkandan
2 years ago
pukkandan 6929b41a21
Remove Python 3.6 support
Closes #3764
2 years ago
pukkandan f5e438a976
[compat] Let PyInstaller detect _legacy module 2 years ago
pukkandan 54007a45f1
[cleanup] Consistent style for file heads 2 years ago
pukkandan 57e0f077a6
[update] Expose more functionality to API 2 years ago
pukkandan 8a82af3511
[cleanup] Misc fixes and cleanup
Closes #3780, Closes #3853, Closes #3850
2 years ago
pukkandan 53973b4d2c
[utils] Fix bug in 0b9c08b47b
* Cache of `supports_terminal_sequences` must be reset after enabling VT mode
* and move `windows_enable_vt_mode` to utils to avoid cyclic imports
2 years ago
pukkandan 1d485a1a79
[cleanup] Misc fixes
Closes #3565, https://github.com/yt-dlp/yt-dlp/issues/3514#issuecomment-1105944364
2 years ago
pukkandan 9196cbfe8b
[compat] Ensure submodules are correctly wrapped 2 years ago
pukkandan 9b8ee23b99
[dependencies] Create module with all dependency imports 2 years ago
felix 77f9033095
[compat] Split into sub-modules (#2173)
Authored by: fstirlitz, pukkandan
2 years ago