Simon Sawicki ff07792676

[core] Prevent RCE when using --exec with %q (CVE-2024-22423) ...

The shell escape function now properly escapes `%`, `\\` and `\n`. `utils.Popen` as well as `%q` output template expansion have been patched accordingly.

Prior to this fix using `--exec` together with `%q` when on Windows could cause remote code to execute. See https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-hjq6-52gw-2g7p for more details.

Authored by: Grub4K

2024-04-09 18:36:13 +02:00

..

testdata

Improve plugin architecture (#5553)

2023-01-01 04:29:22 +00:00

__init__.py

Add support for single-test tox runs

2013-10-12 13:17:11 -04:00

conftest.py

[rh:websockets] Migrate websockets to networking framework (#7720)

2023-11-20 08:04:04 +00:00

helper.py

[ie] Migrate commonly plural fields to lists (#8917)

2024-02-20 12:49:24 +05:30

parameters.json

[cleanup] Misc

2022-11-16 06:57:07 +05:30

test_aes.py

[dependencies] Simplify Cryptodome

2023-02-28 23:15:13 +05:30

test_age_restriction.py

Update to ytdl-commit-2dd6c6e

2023-02-17 17:52:23 +05:30

test_all_urls.py

[cleanup] Consistent style for file heads

2022-06-25 00:08:58 +05:30

test_cache.py

[cleanup] Consistent style for file heads

2022-06-25 00:08:58 +05:30

test_compat.py

[compat] Ensure submodules are imported correctly

2023-07-22 18:10:35 +05:30

test_config.py

Fix config locations (#5933)

2023-01-07 00:31:00 +05:30

test_cookies.py

[cleanup] Standardize import datetime as dt (#8978)

2024-04-01 05:32:15 +05:30

test_download.py

[test:download] Test for expected_exception

2023-09-21 17:48:57 -05:00

test_downloader_external.py

[fd/external] Fix ffmpeg input from stdin (#7655)

2023-07-22 02:32:49 +00:00

test_downloader_http.py

[utils] Add temporary shim for logging

2023-07-15 16:18:34 +05:30

test_execution.py

[docs] Misc Cleanup (#8977)

2024-03-11 00:48:47 +05:30

test_InfoExtractor.py

[utils] FormatSorter: Improve size and br

2023-06-21 06:10:38 +05:30

test_iqiyi_sdk_interpreter.py

[cleanup] Consistent style for file heads

2022-06-25 00:08:58 +05:30

test_jsinterp.py

Update to ytdl-commit-07af47

2023-06-21 09:21:23 +05:30

test_netrc.py

[cleanup] Consistent style for file heads

2022-06-25 00:08:58 +05:30

test_networking_utils.py

[networking] Remove _CompatHTTPError (#8871)

2024-01-20 15:26:50 +13:00

test_networking.py

[rh:curlcffi] Add support for curl_cffi

2024-03-16 23:15:11 -05:00

test_overwrites.py

[cleanup] Consistent style for file heads

2022-06-25 00:08:58 +05:30

test_plugins.py

Improve plugin architecture (#5553)

2023-01-01 04:29:22 +00:00

test_post_hooks.py

[cleanup] Consistent style for file heads

2022-06-25 00:08:58 +05:30

test_postprocessors.py

[SponsorBlock] Support chapter category (#5260)

2022-10-18 22:21:57 +05:30

test_socks.py

[rh:curlcffi] Add support for curl_cffi

2024-03-16 23:15:11 -05:00

test_subtitles.py

[cleanup] Consistent style for file heads

2022-06-25 00:08:58 +05:30

test_traversal.py

[cleanup] Misc (#9426)

2024-04-09 16:12:26 +00:00

test_update.py

[cleanup] Misc (#8598)

2023-12-30 22:27:36 +01:00

test_utils.py

[core] Prevent RCE when using --exec with %q (CVE-2024-22423)

2024-04-09 18:36:13 +02:00

test_verbose_output.py

[cleanup] Consistent style for file heads

2022-06-25 00:08:58 +05:30

test_websockets.py

[test] Workaround websocket server hanging (#9467)

2024-03-16 16:57:21 +13:00

test_write_annotations.py.disabled

[cleanup] Consistent style for file heads

2022-06-25 00:08:58 +05:30

test_youtube_lists.py

[extractor/youtube:tab] Update tab handling for redesign (#5439)

2022-11-09 14:28:44 +05:30

test_youtube_misc.py

[cleanup] Consistent style for file heads

2022-06-25 00:08:58 +05:30

test_youtube_signature.py

[extractor/youtube] Improve nsig function name extraction

2023-06-22 13:27:18 +05:30

test_YoutubeDL.py

Infer acodec for single-codec containers

2024-03-31 22:50:21 +05:30

test_YoutubeDLCookieJar.py

[cleanup] Misc fixes

2023-07-22 09:09:52 +05:30

testcert.pem

Add a test for --no-check-certificate

2015-01-30 02:57:37 +01:00