diff options
| author | Simon Sawicki <contact@grub4k.xyz> | 2023-07-06 21:51:04 +0530 |
|---|---|---|
| committer | pukkandan <pukkandan.ytdlp@gmail.com> | 2023-07-06 23:14:39 +0530 |
| commit | 3121512228487c9c690d3d39bfd2579addf96e07 (patch) | |
| tree | b84e0db5b8db1b07a190630a4f00bda081d4171b /yt_dlp/downloader/common.py | |
| parent | f8b4bcc0a791274223723488bfbfc23ea3276641 (diff) | |
| download | hypervideo-pre-3121512228487c9c690d3d39bfd2579addf96e07.tar.lz hypervideo-pre-3121512228487c9c690d3d39bfd2579addf96e07.tar.xz hypervideo-pre-3121512228487c9c690d3d39bfd2579addf96e07.zip | |
[core] Change how `Cookie` headers are handled
Cookies are now saved and loaded under `cookies` key in the info dict
instead of `http_headers.Cookie`. Cookies passed in headers are
auto-scoped to the input URLs with a warning.
Ref: https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-v8mc-9377-rwjj
Authored by: Grub4K
Diffstat (limited to 'yt_dlp/downloader/common.py')
| -rw-r--r-- | yt_dlp/downloader/common.py | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/yt_dlp/downloader/common.py b/yt_dlp/downloader/common.py index 8fe9d9993..2c404ee90 100644 --- a/yt_dlp/downloader/common.py +++ b/yt_dlp/downloader/common.py @@ -32,6 +32,7 @@ from ..utils import ( timetuple_from_msec, try_call, ) +from ..utils.traversal import traverse_obj class FileDownloader: @@ -419,7 +420,6 @@ class FileDownloader: """Download to a filename using the info from info_dict Return True on success and False otherwise """ - nooverwrites_and_exists = ( not self.params.get('overwrites', True) and os.path.exists(encodeFilename(filename)) @@ -453,6 +453,11 @@ class FileDownloader: self.to_screen(f'[download] Sleeping {sleep_interval:.2f} seconds ...') time.sleep(sleep_interval) + # Filter the `Cookie` header from the info_dict to prevent leaks. + # See: https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-v8mc-9377-rwjj + info_dict['http_headers'] = dict(traverse_obj(info_dict, ( + 'http_headers', {dict.items}, lambda _, pair: pair[0].lower() != 'cookie'))) or None + ret = self.real_download(filename, info_dict) self._finish_multiline_status() return ret, True |