Mirror_Repos/yt-dlp_yt-dlp
2
0
Fork 0
Code Issues Pull Requests Actions 7 Packages Projects Releases Wiki Activity

[cleanup] Misc (#16697)

Browse Source 
Authored by: Grub4K, bashonly

Co-authored-by: bashonly <bashonly@protonmail.com>
This commit is contained in:
Simon Sawicki
2026-06-10 01:01:32 +02:00
committed by GitHub
parent 25056f0d2d
commit 821bef0f00
7 changed files with 51 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
yt_dlp/YoutubeDL.py
+13 -3
View File
@@ -1313,6 +1313,7 @@ class YoutubeDL:
)$''')
SAFE_EXEC_CONVERSIONS = 'difq'
UNSAFE_DEFAULT_CHARS = '"\' \n\t;&|^$%*<>{}()[]`#\\'
EXEC_ADVISORY_MSG = 'See https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-69qj-pvh9-c5wg for details'
def _from_user_input(field):
if field == ':':
@@ -1440,12 +1441,21 @@ class YoutubeDL:
# Validate safety of exec commands
if _exec:
if fmt[-1] not in SAFE_EXEC_CONVERSIONS:
raise UnsafeExecExpansionError(f'Unsafe conversion(s) in exec command: {outtmpl!r}')
raise UnsafeExecExpansionError(
f'Unsafe conversion(s) in exec command: {outtmpl!r}\n'
f'Conversions such as %()s are too dangerous to be used in '
f'--exec command templates; use %()q instead. {EXEC_ADVISORY_MSG}')
elif any(unsafe_char in default for unsafe_char in UNSAFE_DEFAULT_CHARS):
if default == na:
raise UnsafeExecExpansionError(f'Unsafe placeholder for exec command: {na!r}')
raise UnsafeExecExpansionError(
f'Unsafe placeholder for exec command: {na!r}\n'
f'The --output-na-placeholder argument also applies to '
f'--exec command templates. {EXEC_ADVISORY_MSG}')
else:
raise UnsafeExecExpansionError(f'Unsafe default(s) in exec command: {outtmpl!r}')
raise UnsafeExecExpansionError(
f'Unsafe default(s) in exec command: {outtmpl!r}\n'
f'Conversions are not applied to --exec command template defaults, '
f'e.g. %(...|DEFAULT;)q. {EXEC_ADVISORY_MSG}')
flags = outer_mobj.group('conversion') or ''
str_fmt = f'{fmt[:-1]}s'