summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorRicardo Constantino <wiiaboo@gmail.com>2018-01-26 01:19:04 +0000
committerRicardo Constantino <wiiaboo@gmail.com>2018-01-26 01:47:43 +0000
commite6e6b0dcc7e9b0dbf35154a179b3dc1fcfcaff43 (patch)
tree851912c864c67e1eeee25942422e4ce1d4b76cf4
parentab868fe425a29b58851ed191b678db31f0ed5e81 (diff)
downloadmpv-e6e6b0dcc7e9b0dbf35154a179b3dc1fcfcaff43.tar.bz2
mpv-e6e6b0dcc7e9b0dbf35154a179b3dc1fcfcaff43.tar.xz
ytdl_hook: whitelist protocols from urls retrieved from youtube-dl
Not very clean since there's a lot of potential unsafe urls that youtube-dl can give us, depending on whether it's a single url, split tracks, playlists, segmented dash, etc.
-rw-r--r--player/lua/ytdl_hook.lua54
1 files changed, 47 insertions, 7 deletions
diff --git a/player/lua/ytdl_hook.lua b/player/lua/ytdl_hook.lua
index dd96ecc01d..b480c21625 100644
--- a/player/lua/ytdl_hook.lua
+++ b/player/lua/ytdl_hook.lua
@@ -16,6 +16,18 @@ local ytdl = {
local chapter_list = {}
+function Set (t)
+ local set = {}
+ for _, v in pairs(t) do set[v] = true end
+ return set
+end
+
+local safe_protos = Set {
+ "http", "https", "ftp", "ftps",
+ "rtmp", "rtmps", "rtmpe", "rtmpt", "rtmpts", "rtmpte",
+ "data"
+}
+
local function exec(args)
local ret = utils.subprocess({args = args})
return ret.status, ret.stdout, ret
@@ -183,6 +195,9 @@ local function edl_track_joined(fragments, protocol, is_live, base)
for i = offset, #fragments do
local fragment = fragments[i]
+ if not url_is_safe(join_url(base, fragment)) then
+ return nil
+ end
table.insert(parts, edl_escape(join_url(base, fragment)))
if fragment.duration then
parts[#parts] =
@@ -208,6 +223,15 @@ local function proto_is_dash(json)
or json["protocol"] == "http_dash_segments"
end
+local function url_is_safe(url)
+ local proto = type(url) == "string" and url:match("^(.+)://") or nil
+ local safe = proto and safe_protos[proto]
+ if not safe then
+ msg.error(("Ignoring potentially unsafe url: '%s'"):format(url))
+ end
+ return safe
+end
+
local function add_single_video(json)
local streamurl = ""
local max_bitrate = 0
@@ -218,6 +242,8 @@ local function add_single_video(json)
if not mpd_url then
msg.error("No manifest URL found in JSON data.")
return
+ elseif not url_is_safe(mpd_url) then
+ return
end
streamurl = mpd_url
@@ -238,14 +264,18 @@ local function add_single_video(json)
edl_track = edl_track_joined(track.fragments,
track.protocol, json.is_live,
track.fragment_base_url)
+ local url = edl_track or track.url
+ if not url_is_safe(url) then
+ return
+ end
if track.acodec and track.acodec ~= "none" then
-- audio track
mp.commandv("audio-add",
- edl_track or track.url, "auto",
+ url, "auto",
track.format_note or "")
elseif track.vcodec and track.vcodec ~= "none" then
-- video track
- streamurl = edl_track or track.url
+ streamurl = url
end
end
@@ -264,7 +294,13 @@ local function add_single_video(json)
msg.debug("streamurl: " .. streamurl)
- mp.set_property("stream-open-filename", streamurl:gsub("^data:", "data://", 1))
+ streamurl = streamurl:gsub("^data:", "data://", 1)
+
+ if not url_is_safe(streamurl) then
+ return
+ end
+
+ mp.set_property("stream-open-filename", streamurl)
mp.set_property("file-local-options/force-media-title", json.title)
@@ -526,14 +562,18 @@ mp.add_hook(o.try_ytdl_first and "on_load" or "on_load_fail", 10, function ()
site = entry["webpage_url"]
end
- if not (site:find("https?://") == 1) then
- site = "ytdl://" .. site
+ -- links with only youtube id as returned by --flat-playlist
+ if not site:find("://") then
+ table.insert(playlist, "ytdl://" .. site)
+ elseif url_is_safe(site) then
+ table.insert(playlist, site)
end
- table.insert(playlist, site)
end
- mp.set_property("stream-open-filename", "memory://" .. table.concat(playlist, "\n"))
+ if #playlist > 0 then
+ mp.set_property("stream-open-filename", "memory://" .. table.concat(playlist, "\n"))
+ end
end
else -- probably a video