You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
yt-dlp/test
Simon Sawicki ff07792676
[core] Prevent RCE when using `--exec` with `%q` (CVE-2024-22423)
The shell escape function now properly escapes `%`, `\\` and `\n`. `utils.Popen` as well as `%q` output template expansion have been patched accordingly.

Prior to this fix using `--exec` together with `%q` when on Windows could cause remote code to execute. See https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-hjq6-52gw-2g7p for more details.

Authored by: Grub4K
7 months ago
..
testdata
__init__.py
conftest.py [rh:websockets] Migrate websockets to networking framework (#7720) 12 months ago
helper.py [ie] Migrate commonly plural fields to lists (#8917) 9 months ago
parameters.json
test_InfoExtractor.py
test_YoutubeDL.py Infer `acodec` for single-codec containers 7 months ago
test_YoutubeDLCookieJar.py [cleanup] Misc fixes 1 year ago
test_aes.py
test_age_restriction.py
test_all_urls.py
test_cache.py
test_compat.py [compat] Ensure submodules are imported correctly 1 year ago
test_config.py
test_cookies.py [cleanup] Standardize `import datetime as dt` (#8978) 7 months ago
test_download.py [test:download] Test for `expected_exception` 1 year ago
test_downloader_external.py [fd/external] Fix ffmpeg input from stdin (#7655) 1 year ago
test_downloader_http.py [utils] Add temporary shim for logging 1 year ago
test_execution.py [docs] Misc Cleanup (#8977) 8 months ago
test_iqiyi_sdk_interpreter.py
test_jsinterp.py
test_netrc.py
test_networking.py [rh:curlcffi] Add support for `curl_cffi` 8 months ago
test_networking_utils.py [networking] Remove `_CompatHTTPError` (#8871) 10 months ago
test_overwrites.py
test_plugins.py
test_post_hooks.py
test_postprocessors.py
test_socks.py [rh:curlcffi] Add support for `curl_cffi` 8 months ago
test_subtitles.py
test_traversal.py [cleanup] Misc (#9426) 7 months ago
test_update.py [cleanup] Misc (#8598) 10 months ago
test_utils.py [core] Prevent RCE when using `--exec` with `%q` (CVE-2024-22423) 7 months ago
test_verbose_output.py
test_websockets.py [test] Workaround websocket server hanging (#9467) 8 months ago
test_write_annotations.py.disabled
test_youtube_lists.py
test_youtube_misc.py
test_youtube_signature.py [extractor/youtube] Improve nsig function name extraction 1 year ago
testcert.pem