mirrors/yt-dlp
1
0
Fork 0
mirror of https://github.com/yt-dlp/yt-dlp.git synced 2025-10-31 14:45:14 +00:00
Code Issues Projects Releases Wiki Activity

[ie] Do not smuggle http_headers

Browse Source 
See: https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-3ch3-jhc6-5r8x

Authored by: coletdjnz
This commit is contained in:
bashonly
2023-08-16 18:42:48 -05:00
committed by Simon Sawicki
parent d4f14a72dc
commit f04b5bedad
9 changed files with 19 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
yt_dlp/extractor/vimeo.py
View File

@@ -37,14 +37,14 @@ class VimeoBaseInfoExtractor(InfoExtractor):
@staticmethod
def _smuggle_referrer(url, referrer_url):
return smuggle_url(url, {'http_headers': {'Referer': referrer_url}})
return smuggle_url(url, {'referer': referrer_url})
def _unsmuggle_headers(self, url):
"""@returns (url, smuggled_data, headers)"""
url, data = unsmuggle_url(url, {})
headers = self.get_param('http_headers').copy()
if 'http_headers' in data:
headers.update(data['http_headers'])
if 'referer' in data:
headers['Referer'] = data['referer']
return url, data, headers
def _perform_login(self, username, password):