Skip to content
Commits on Source (7)
Show whitespace changes
Inline Side-by-side
debian/changelog
View file @ 96e932ec
mpv (0.23.0-2+deb9u2) stretch-security; urgency=high
* debian/patches/08_ytdl-hook-whitelist-protocols.patch:
- Fix regression in CVE-2018-6360 patch which broke youtube playlists.
(Closes: #889892)
-- James Cowgill <jcowgill@debian.org> Thu, 08 Feb 2018 12:27:06 +0000
mpv (0.23.0-2+deb9u1) stretch-security; urgency=high
* debian/patches/08_ytdl-hook-whitelist-protocols.patch:
- Add patch which whitelists protocols received from youtube-dl.
Fixes CVE-2018-6360. (Closes: #888654)
-- James Cowgill <jcowgill@debian.org> Sat, 03 Feb 2018 15:05:34 +0100
mpv (0.23.0-2) unstable; urgency=medium
* Add patch from upstream fix segfaults on tv input.
......
debian/gbp.conf 0 → 100644
View file @ 96e932ec
[DEFAULT]
pristine-tar = True
debian-branch = debian/stretch
upstream-branch = upstream/0.23.x
debian/patches/08_ytdl-hook-whitelist-protocols.patch 0 → 100644
View file @ 96e932ec
Description: ytdl_hook: whitelist protocols from urls retrieved from youtube-dl
This patch is a combination of these upstream commits:
- e6e6b0dcc7e9 ("ytdl_hook: whitelist protocols from urls retrieved from
youtube-dl")
- f8263e82cc74 ("ytdl_hook: move url_is_safe earlier in code")
- ce42a965330d ("ytdl_hook: fix safe url checking with EDL urls")
.
jcowgill: heavily backported to 0.23
Fixes CVE-2018-6360
Author: Ricardo Constantino <wiiaboo@gmail.com>
Bug: https://github.com/mpv-player/mpv/issues/5456
Bug-Debian: https://bugs.debian.org/888654
Bug-Debian: https://bugs.debian.org/889892
Applied-Upstream: v0.29
---
This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
--- a/player/lua/ytdl_hook.lua
+++ b/player/lua/ytdl_hook.lua
@@ -8,6 +8,18 @@ local ytdl = {
local chapter_list = {}
+function Set (t)
+ local set = {}
+ for _, v in pairs(t) do set[v] = true end
+ return set
+end
+
+local safe_protos = Set {
+ "http", "https", "ftp", "ftps",
+ "rtmp", "rtmps", "rtmpe", "rtmpt", "rtmpts", "rtmpte",
+ "data"
+}
+
local function exec(args)
local ret = utils.subprocess({args = args})
return ret.status, ret.stdout, ret
@@ -59,6 +71,15 @@ local function edl_escape(url)
return "%" .. string.len(url) .. "%" .. url
end
+local function url_is_safe(url)
+ local proto = type(url) == "string" and url:match("^(.+)://") or nil
+ local safe = proto and safe_protos[proto]
+ if not safe then
+ msg.error(("Ignoring potentially unsafe url: '%s'"):format(url))
+ end
+ return safe
+end
+
local function time_to_secs(time_string)
local ret
@@ -192,6 +213,9 @@ mp.add_hook("on_load", 10, function ()
local playlist = "edl://"
for i, entry in pairs(json.entries) do
+ if not url_is_safe(entry.url) then
+ return
+ end
playlist = playlist .. edl_escape(entry.url)
if not (entry.duration == nil) then
playlist = playlist..",start=0,length="..entry.duration
@@ -261,7 +285,11 @@ mp.add_hook("on_load", 10, function ()
site = entry["webpage_url"]
end
- playlist = playlist .. "ytdl://" .. site .. "\n"
+ if not site:find("://") then
+ playlist = playlist .. "ytdl://" .. site .. "\n"
+ elseif url_is_safe(site) then
+ playlist = playlist .. site .. "\n"
+ end
end
mp.set_property("stream-open-filename", "memory://" .. playlist)
@@ -279,14 +307,24 @@ mp.add_hook("on_load", 10, function ()
-- video url
streamurl = json["requested_formats"][1].url
+ if not url_is_safe(streamurl) then
+ return
+ end
-- audio url
+ if not url_is_safe(json["requested_formats"][2].url) then
+ return
+ end
mp.commandv("audio-add", json["requested_formats"][2].url,
"select", json["requested_formats"][2]["format_note"] or "")
elseif not (json.url == nil) then
-- normal video
streamurl = json.url
+ if not url_is_safe(streamurl) then
+ return
+ end
+
set_http_headers(json.http_headers)
else
msg.error("No URL found in JSON data.")
debian/patches/series
View file @ 96e932ec
......@@ -4,3 +4,4 @@
05_add-keywords.patch
06_ffmpeg-abi.patch
07_segfaults-on-tv-input.patch
08_ytdl-hook-whitelist-protocols.patch