Fix: prevent yt-dlp argument injection via unsanitized URL (RCE) - #58
Open
robomello wants to merge 1 commit into
Open
Fix: prevent yt-dlp argument injection via unsanitized URL (RCE)#58robomello wants to merge 1 commit into
robomello wants to merge 1 commit into
Conversation
The url field from POST /api/download, /api/info, and /api/playlist was passed straight into the yt-dlp argv list. Since these endpoints are unauthenticated, a caller could pass a value like "--exec=<cmd>" instead of a real URL; yt-dlp parses any argv item starting with "-" as an option rather than a positional URL, so this allowed arbitrary command execution on the host after a (fake) download. Fixes: - Add is_safe_url() to require an http(s) scheme + host, rejecting anything that could be interpreted as a CLI flag. - Insert a "--" argv separator before the URL in every yt-dlp invocation so option parsing stops regardless of URL content (defense in depth alongside the scheme check). - Apply the check on all three endpoints that accept a URL.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
urlfrom the unauthenticatedPOST /api/download,/api/info, and/api/playlistendpoints was passed straight into theyt-dlpargv list (app.py). Since it's the last positional argument with nothing separating it from option parsing, a caller can submit something like:{"url": "--exec=touch /tmp/pwned; true"}yt-dlptreats any argv item starting with-/--as a flag rather than a URL, so this reaches--exec(or--exec-before-download,--print, etc.) and results in arbitrary command execution on the host as the process user, with no auth required.Fix
is_safe_url()— requires anhttp/httpsscheme and a host, rejecting anything that could parse as a CLI flag.--argv separator before the URL in everyyt-dlpinvocation so option parsing stops at that point regardless of URL content (defense in depth alongside the scheme check)./api/download,/api/info,/api/playlist).Testing
python3 -m py_compile app.pypasses.is_safe_urlrejects--exec=...,-o=..., empty strings, and non-http(s) schemes, and accepts normalhttps://...URLs.Happy to adjust the validation approach (e.g. stricter allow-list of domains) if you'd prefer a different shape for the fix.