danvics/metube
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Block dangerous yt-dlp options in ytdl_options_overrides

Browse source 
When ALLOW_YTDL_OPTIONS_OVERRIDES is enabled, arbitrary yt-dlp
options are accepted and passed directly to yt-dlp without
restriction. This allows injection of the Exec postprocessor or
exec_cmd option, which executes arbitrary OS commands on the server
after a download completes.

Add a blocklist of dangerous yt-dlp option keys (exec_cmd, exec,
postprocessors, post_hooks, external_downloader,
external_downloader_args, cookiefile, cookiesfrombrowser) that are
rejected with a 400 error when present in overrides.
This commit is contained in:
az10b 2026-04-09 19:47:24 -05:00 committed by aazad
parent 0b3645aea1
commit 636fc7ce6e
1 changed files with 10 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
app/main.py
View file

@ -234,6 +234,12 @@ VALID_VIDEO_CODECS = {'auto', 'h264', 'h265', 'av1', 'vp9'}
VALID_VIDEO_FORMATS = {'any', 'mp4', 'ios'} VALID_VIDEO_FORMATS = {'any', 'mp4', 'ios'}
VALID_AUDIO_FORMATS = {'m4a', 'mp3', 'opus', 'wav', 'flac'} VALID_AUDIO_FORMATS = {'m4a', 'mp3', 'opus', 'wav', 'flac'}
VALID_THUMBNAIL_FORMATS = {'jpg'} VALID_THUMBNAIL_FORMATS = {'jpg'}
_BLOCKED_YTDL_OVERRIDE_KEYS = frozenset({
'exec_cmd', 'exec', 'postprocessors', 'post_hooks',
'external_downloader', 'external_downloader_args',
'cookiefile', 'cookiesfrombrowser',
})
def _parse_ytdl_options_overrides(value, *, enabled: bool) -> dict: def _parse_ytdl_options_overrides(value, *, enabled: bool) -> dict:
if value is None or value == '': if value is None or value == '':
return {} return {}
@ -250,6 +256,10 @@ def _parse_ytdl_options_overrides(value, *, enabled: bool) -> dict:
if value and not enabled: if value and not enabled:
raise web.HTTPBadRequest(reason='ytdl_options_overrides are disabled') raise web.HTTPBadRequest(reason='ytdl_options_overrides are disabled')
blocked = set(value.keys()) & _BLOCKED_YTDL_OVERRIDE_KEYS
if blocked:
raise web.HTTPBadRequest(reason=f'ytdl_options_overrides contains blocked keys: {sorted(blocked)}')
return value return value