diff options
| author | Simon Sawicki <contact@grub4k.xyz> | 2023-09-24 02:29:01 +0200 |
|---|---|---|
| committer | Simon Sawicki <contact@grub4k.xyz> | 2023-09-24 02:29:01 +0200 |
| commit | de015e930747165dbb8fcd360f8775fd973b7d6e (patch) | |
| tree | 7588e5aefdba5eb635a8690b824b1a49672342d8 /test/test_YoutubeDL.py | |
| parent | 61bdf15fc7400601c3da1aa7a43917310a5bf391 (diff) | |
[core] Prevent RCE when using `--exec` with `%q` (CVE-2023-40581)
The shell escape function is now using `""` instead of `\"`. `utils.Popen` has been patched to properly quote commands.
Prior to this fix using `--exec` together with `%q` when on Windows could cause remote code to execute. See https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-42h4-v29r-42qg for reference.
Authored by: Grub4K
Diffstat (limited to 'test/test_YoutubeDL.py')
| -rw-r--r-- | test/test_YoutubeDL.py | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/test/test_YoutubeDL.py b/test/test_YoutubeDL.py index 916ee48b9..0cf130db0 100644 --- a/test/test_YoutubeDL.py +++ b/test/test_YoutubeDL.py @@ -784,9 +784,9 @@ class TestYoutubeDL(unittest.TestCase): test('%(title4)#S', 'foo_bar_test') test('%(title4).10S', ('foo ＂bar＂ ', 'foo ＂bar＂' + ('#' if compat_os_name == 'nt' else ' '))) if compat_os_name == 'nt': - test('%(title4)q', ('"foo \\"bar\\" test"', "＂foo ⧹＂bar⧹＂ test＂")) - test('%(formats.:.id)#q', ('"id 1" "id 2" "id 3"', '＂id 1＂ ＂id 2＂ ＂id 3＂')) - test('%(formats.0.id)#q', ('"id 1"', '＂id 1＂')) + test('%(title4)q', ('"foo ""bar"" test"', None)) + test('%(formats.:.id)#q', ('"id 1" "id 2" "id 3"', None)) + test('%(formats.0.id)#q', ('"id 1"', None)) else: test('%(title4)q', ('\'foo "bar" test\'', '\'foo ＂bar＂ test\'')) test('%(formats.:.id)#q', "'id 1' 'id 2' 'id 3'") |