diff options
| author | coletdjnz <coletdjnz@protonmail.com> | 2023-06-06 20:44:51 +1200 |
|---|---|---|
| committer | pukkandan <pukkandan.ytdlp@gmail.com> | 2023-07-06 23:14:39 +0530 |
| commit | f8b4bcc0a791274223723488bfbfc23ea3276641 (patch) | |
| tree | 8575879cf984a8b7a6f5ee6d545ac2b82d0d30bb /yt_dlp/utils/_utils.py | |
| parent | 1ceb657bdd254ad961489e5060f2ccc7d556b729 (diff) | |
[core] Prevent `Cookie` leaks on HTTP redirect
Ref: https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-v8mc-9377-rwjj
Authored by: coletdjnz
Diffstat (limited to 'yt_dlp/utils/_utils.py')
| -rw-r--r-- | yt_dlp/utils/_utils.py | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/yt_dlp/utils/_utils.py b/yt_dlp/utils/_utils.py index f68cdb968..82d9ba4d5 100644 --- a/yt_dlp/utils/_utils.py +++ b/yt_dlp/utils/_utils.py @@ -1556,7 +1556,12 @@ class YoutubeDLRedirectHandler(urllib.request.HTTPRedirectHandler): new_method = req.get_method() new_data = req.data - remove_headers = [] + + # Technically the Cookie header should be in unredirected_hdrs, + # however in practice some may set it in normal headers anyway. + # We will remove it here to prevent any leaks. + remove_headers = ['Cookie'] + # A 303 must either use GET or HEAD for subsequent request # https://datatracker.ietf.org/doc/html/rfc7231#section-6.4.4 if code == 303 and req.get_method() != 'HEAD': @@ -1573,7 +1578,7 @@ class YoutubeDLRedirectHandler(urllib.request.HTTPRedirectHandler): new_data = None remove_headers.extend(['Content-Length', 'Content-Type']) - new_headers = {k: v for k, v in req.headers.items() if k.lower() not in remove_headers} + new_headers = {k: v for k, v in req.headers.items() if k.title() not in remove_headers} return urllib.request.Request( newurl, headers=new_headers, origin_req_host=req.origin_req_host, |