diff options
author | dirkf <fieldhouse@gmx.net> | 2023-06-07 19:38:54 +0100 |
---|---|---|
committer | dirkf <fieldhouse@gmx.net> | 2023-07-18 10:50:46 +0100 |
commit | b383be98874d4dded67ee8a679fae30340722709 (patch) | |
tree | e9da83eb42785c0fd1e0927bac3f3e85b58d2894 /youtube_dl | |
parent | 46fde7caeeab13a6277aab22a0e8a29e10c30cc3 (diff) | |
download | youtube-dl-b383be98874d4dded67ee8a679fae30340722709.tar.xz |
[core] Remove `Cookie` header on redirect to prevent leaks
Adated from yt-dlp/yt-dlp-ghsa-v8mc-9377-rwjj/pull/1/commits/101caac
Thx coletdjnz
Diffstat (limited to 'youtube_dl')
-rw-r--r-- | youtube_dl/utils.py | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/youtube_dl/utils.py b/youtube_dl/utils.py index 58c710b08..c21cd3687 100644 --- a/youtube_dl/utils.py +++ b/youtube_dl/utils.py @@ -2968,7 +2968,6 @@ class YoutubeDLRedirectHandler(compat_urllib_request.HTTPRedirectHandler): new_method = req.get_method() new_data = req.data - remove_headers = [] # On python 2 urlh.geturl() may sometimes return redirect URL # as a byte string instead of unicode. This workaround forces @@ -2981,6 +2980,11 @@ class YoutubeDLRedirectHandler(compat_urllib_request.HTTPRedirectHandler): # but it is kept for compatibility with other callers. newurl = newurl.replace(' ', '%20') + # Technically the Cookie header should be in unredirected_hdrs; + # however in practice some may set it in normal headers anyway. + # We will remove it here to prevent any leaks. + remove_headers = ['Cookie'] + # A 303 must either use GET or HEAD for subsequent request # https://datatracker.ietf.org/doc/html/rfc7231#section-6.4.4 if code == 303 and req.get_method() != 'HEAD': @@ -2999,7 +3003,7 @@ class YoutubeDLRedirectHandler(compat_urllib_request.HTTPRedirectHandler): # NB: don't use dict comprehension for python 2.6 compatibility new_headers = dict((k, v) for k, v in req.header_items() - if k.lower() not in remove_headers) + if k.title() not in remove_headers) return compat_urllib_request.Request( newurl, headers=new_headers, origin_req_host=req.origin_req_host, |