public/yt-dlp
1
0
Fork 0
mirror of https://github.com/yt-dlp/yt-dlp.git synced 2026-07-21 23:10:34 +02:00
Code Issues Projects Releases Wiki Activity

[pp/exec] Restrict --exec template usage to safe conversions (#16883)

Browse Source 
Authored by: bashonly
This commit is contained in:
bashonly
2026-06-06 21:24:53 +00:00
committed by GitHub
parent 7aac95eae6
commit 5faffa999f
7 changed files with 103 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
yt_dlp/postprocessor/exec.py
+10 -1
View File
@@ -5,8 +5,17 @@ from ..utils import Popen, PostProcessingError, shell_quote, variadic
class ExecPP(PostProcessor):
def __init__(self, downloader, exec_cmd):
PostProcessor.__init__(self, downloader)
# Need to set exec_cmd attribute before set_downloader is called by PostProcessor.__init__
self.exec_cmd = variadic(exec_cmd)
PostProcessor.__init__(self, downloader)
def set_downloader(self, downloader):
super().set_downloader(downloader)
# Validate safety of exec commands
params = getattr(self._downloader, 'params', None)
if params and 'allow-unsafe-exec-expansion' not in params['compat_opts']:
for cmd in self.exec_cmd:
_ = self._downloader.prepare_outtmpl(cmd, {}, _exec=True)
def parse_cmd(self, cmd, info):
tmpl, tmpl_dict = self._downloader.prepare_outtmpl(cmd, info)