1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
|
Description: ytdl_hook: whitelist protocols from urls retrieved from youtube-dl
This patch is a combination of these upstream commits:
- e6e6b0dcc7e9 ("ytdl_hook: whitelist protocols from urls retrieved from
youtube-dl")
- f8263e82cc74 ("ytdl_hook: move url_is_safe earlier in code")
- ce42a965330d ("ytdl_hook: fix safe url checking with EDL urls")
.
jcowgill: backported to 0.27
Fixes CVE-2018-6360
Author: Ricardo Constantino <wiiaboo@gmail.com>
Bug: https://github.com/mpv-player/mpv/issues/5456
Bug-Debian: https://bugs.debian.org/888654
Applied-Upstream: v0.29
---
This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
--- a/player/lua/ytdl_hook.lua
+++ b/player/lua/ytdl_hook.lua
@@ -15,6 +15,18 @@ local ytdl = {
local chapter_list = {}
+function Set (t)
+ local set = {}
+ for _, v in pairs(t) do set[v] = true end
+ return set
+end
+
+local safe_protos = Set {
+ "http", "https", "ftp", "ftps",
+ "rtmp", "rtmps", "rtmpe", "rtmpt", "rtmpts", "rtmpte",
+ "data"
+}
+
local function exec(args)
local ret = utils.subprocess({args = args})
return ret.status, ret.stdout, ret
@@ -71,6 +83,15 @@ local function edl_escape(url)
return "%" .. string.len(url) .. "%" .. url
end
+local function url_is_safe(url)
+ local proto = type(url) == "string" and url:match("^(.+)://") or nil
+ local safe = proto and safe_protos[proto]
+ if not safe then
+ msg.error(("Ignoring potentially unsafe url: '%s'"):format(url))
+ end
+ return safe
+end
+
local function time_to_secs(time_string)
local ret
@@ -182,6 +203,9 @@ local function edl_track_joined(fragment
for i = offset, #fragments do
local fragment = fragments[i]
+ if not url_is_safe(join_url(base, fragment)) then
+ return nil
+ end
table.insert(parts, edl_escape(join_url(base, fragment)))
if fragment.duration then
parts[#parts] =
@@ -201,6 +225,9 @@ local function add_single_video(json)
edl_track = edl_track_joined(track.fragments,
track.protocol, json.is_live,
track.fragment_base_url)
+ if not edl_track and not url_is_safe(track.url) then
+ return
+ end
if track.acodec and track.acodec ~= "none" then
-- audio track
mp.commandv("audio-add",
@@ -217,6 +244,9 @@ local function add_single_video(json)
edl_track = edl_track_joined(json.fragments, json.protocol,
json.is_live, json.fragment_base_url)
+ if not edl_track and not url_is_safe(json.url) then
+ return
+ end
-- normal video or single track
streamurl = edl_track or json.url
set_http_headers(json.http_headers)
@@ -408,6 +438,10 @@ mp.add_hook("on_load", 10, function ()
msg.debug("EDL: " .. playlist)
+ if not playlist then
+ return
+ end
+
-- can't change the http headers for each entry, so use the 1st
if json.entries[1] then
set_http_headers(json.entries[1].http_headers)
@@ -475,7 +509,9 @@ mp.add_hook("on_load", 10, function ()
site = entry["webpage_url"]
end
- playlist = playlist .. "ytdl://" .. site .. "\n"
+ if url_is_safe(site) then
+ playlist = playlist .. "ytdl://" .. site .. "\n"
+ end
end
mp.set_property("stream-open-filename", "memory://" .. playlist)
|
