Alex Shnitman 1b02a99510 fix: re-validate outbound connections at fetch time against internal hosts ...

validate_url only inspects the submitted URL string. yt-dlp then follows HTTP
redirects and resolves media URLs from remote metadata without re-checking, so
an allowed URL that 302s to http://169.254.169.254/ (cloud metadata) or an
RFC1918 host is still fetched — the guard's own docstring scoped this out.

Install a getaddrinfo guard in the download subprocess that re-validates every
resolved address at actual connect time, covering redirects and DNS rebinding
for any backend resolving through Python's socket module (urllib, requests).
Loopback is permitted so locally-configured proxies keep working; link-local,
RFC1918 and unique-local are blocked. Native resolvers (curl_cffi/libcurl via
--impersonate) bypass this and rely on network isolation as the backstop.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-21 06:55:29 +03:00

..

tests

fix: re-validate outbound connections at fetch time against internal hosts

2026-07-21 06:55:29 +03:00

bg_tasks.py

fix: harden download lifecycle, subscriptions, and UI robustness

2026-07-12 08:08:14 +03:00

dl_formats.py

fix: harden download lifecycle, subscriptions, and UI robustness

2026-07-12 08:08:14 +03:00

main.py

fix: enforce download-dir containment at the resolved-path chokepoint

2026-07-20 23:44:43 +03:00

state_store.py

fix: fsync parent dir after direct-write fallback for durability parity

2026-07-05 04:11:12 -07:00

subscriptions.py

fix: block SSRF via user-submitted URLs

2026-07-16 21:31:51 +03:00

url_guard.py

fix: re-validate outbound connections at fetch time against internal hosts

2026-07-21 06:55:29 +03:00

ytdl.py

fix: re-validate outbound connections at fetch time against internal hosts

2026-07-21 06:55:29 +03:00