Mirrors/metube
1
0
Fork 1
mirror of https://github.com/alexta69/metube.git synced 2026-07-17 16:47:30 +00:00
Code Issues Projects Releases Packages Wiki Activity
metube/app
History
Alex Shnitman 6d0528783c fix: block SSRF via user-submitted URLs 
User-submitted URLs were passed straight to yt-dlp's generic extractor,
letting the server fetch internal endpoints (cloud metadata, loopback,
RFC1918 hosts). Add a url_guard.validate_url check at every URL ingress
(add, subscribe, and nested playlist recursion) that rejects non-http(s)
schemes and hosts resolving to non-global addresses, while leaving bare
video IDs and search prefixes untouched.
2026-07-16 21:31:51 +03:00
..
tests fix: block SSRF via user-submitted URLs 2026-07-16 21:31:51 +03:00
bg_tasks.py fix: harden download lifecycle, subscriptions, and UI robustness 2026-07-12 08:08:14 +03:00
dl_formats.py fix: harden download lifecycle, subscriptions, and UI robustness 2026-07-12 08:08:14 +03:00
main.py fix: harden download lifecycle, subscriptions, and UI robustness 2026-07-12 08:08:14 +03:00
state_store.py fix: fsync parent dir after direct-write fallback for durability parity 2026-07-05 04:11:12 -07:00
subscriptions.py fix: block SSRF via user-submitted URLs 2026-07-16 21:31:51 +03:00
url_guard.py fix: block SSRF via user-submitted URLs 2026-07-16 21:31:51 +03:00
ytdl.py fix: block SSRF via user-submitted URLs 2026-07-16 21:31:51 +03:00