Alex Shnitman 6d0528783c fix: block SSRF via user-submitted URLs ...

User-submitted URLs were passed straight to yt-dlp's generic extractor,
letting the server fetch internal endpoints (cloud metadata, loopback,
RFC1918 hosts). Add a url_guard.validate_url check at every URL ingress
(add, subscribe, and nested playlist recursion) that rejects non-http(s)
schemes and hosts resolving to non-global addresses, while leaving bare
video IDs and search prefixes untouched.

2026-07-16 21:31:51 +03:00

..

conftest.py

implement tests

2026-03-20 13:12:31 +02:00

test_api.py

fix: harden download lifecycle, subscriptions, and UI robustness

2026-07-12 08:08:14 +03:00

test_bg_tasks.py

fix: harden download lifecycle, subscriptions, and UI robustness

2026-07-12 08:08:14 +03:00

test_config.py

fix: harden download lifecycle, subscriptions, and UI robustness

2026-07-12 08:08:14 +03:00

test_dl_formats.py

fix: harden download lifecycle, subscriptions, and UI robustness

2026-07-12 08:08:14 +03:00

test_download_queue.py

fix: harden download lifecycle, subscriptions, and UI robustness

2026-07-12 08:08:14 +03:00

test_main_helpers.py

fix: harden download lifecycle, subscriptions, and UI robustness

2026-07-12 08:08:14 +03:00

test_nightly_update.py

add option for following nightly yt-dlp releases (closes #999)

2026-06-06 09:42:26 +03:00

test_persistent_queue.py

add subscriptions; change persistence file format to JSON (closes #901, #76, #113, #170, #242, #444, #503, #555, #566)

2026-04-01 14:33:24 +03:00

test_state_store.py

fix: serialize state before truncating in the direct-write fallback

2026-07-05 04:04:54 -07:00

test_subscriptions.py

fix: harden download lifecycle, subscriptions, and UI robustness

2026-07-12 08:08:14 +03:00

test_url_guard.py

fix: block SSRF via user-submitted URLs

2026-07-16 21:31:51 +03:00

test_ytdl_utils.py

fix: prevent playlist/channel title path traversal (closes GHSA-vh67-38x4-w8pc)

2026-07-13 23:07:39 +03:00