Alex Shnitman e061a8a5ba feat: ALLOW_PRIVATE_ADDRESSES to opt out of the SSRF checks (closes #1036) ...

The SSRF guard rejects any address that isn't globally routable, which breaks
proxy/VPN setups that resolve hosts into private or special-use ranges. The
reported case is Fake-IP clients (sing-box, Clash, Mihomo) that map YouTube to
the RFC 2544 benchmarking range 198.18.0.0/15 to tunnel the traffic; MeTube
rejected it with "Refusing to fetch internal address" even though yt-dlp itself
handles it fine.

Add a boolean ALLOW_PRIVATE_ADDRESSES (default false) that, when set, skips both
layers: validate_url returns after scheme validation without the internal-host
checks, and the connect-time socket guard is not installed. Threaded to the
download subprocess via Download so the guard sees it too. Scheme validation
(http/https only) still applies. Documented in the README as a trust-your-network
opt-out that disables SSRF protection.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-21 07:44:38 +03:00

..

conftest.py

implement tests

2026-03-20 13:12:31 +02:00

test_api.py

fix: enforce download-dir containment at the resolved-path chokepoint

2026-07-20 23:44:43 +03:00

test_bg_tasks.py

fix: harden download lifecycle, subscriptions, and UI robustness

2026-07-12 08:08:14 +03:00

test_config.py

fix: harden download lifecycle, subscriptions, and UI robustness

2026-07-12 08:08:14 +03:00

test_dl_formats.py

fix: harden download lifecycle, subscriptions, and UI robustness

2026-07-12 08:08:14 +03:00

test_download_queue.py

fix: harden download lifecycle, subscriptions, and UI robustness

2026-07-12 08:08:14 +03:00

test_main_helpers.py

fix: harden download lifecycle, subscriptions, and UI robustness

2026-07-12 08:08:14 +03:00

test_nightly_update.py

add option for following nightly yt-dlp releases (closes #999)

2026-06-06 09:42:26 +03:00

test_persistent_queue.py

add subscriptions; change persistence file format to JSON (closes #901, #76, #113, #170, #242, #444, #503, #555, #566)

2026-04-01 14:33:24 +03:00

test_state_store.py

fix: serialize state before truncating in the direct-write fallback

2026-07-05 04:04:54 -07:00

test_subscriptions.py

fix: harden download lifecycle, subscriptions, and UI robustness

2026-07-12 08:08:14 +03:00

test_url_guard.py

feat: ALLOW_PRIVATE_ADDRESSES to opt out of the SSRF checks (closes #1036)

2026-07-21 07:44:38 +03:00

test_ytdl_utils.py

fix: enforce download-dir containment at the resolved-path chokepoint

2026-07-20 23:44:43 +03:00