Release 0.28.2

This was overlooked when doing the whitelisting for video and audio to
fix #5456.

RELEASE_NOTES

@@ -1,3 +1,21 @@
+Release 0.28.2
+==============
+
+This release contains an additional fix for CVE-2018-6360.
+
+Fixes and Minor Enhancements
+----------------------------
+- ytdl_hook: whitelist subtitle URLs as well (#5456)
+
+Release 0.28.1
+==============
+
+This release fixes CVE-2018-6360.
+
+Fixes and Minor Enhancements
+----------------------------
+- ytdl_hook:  whitelist protocols from urls retrieved from youtube-dl (#5456)
+
 Release 0.28.0
 ==============
 

VERSION

@@ -1 +1 @@
-0.28.0
+0.28.2

player/lua/ytdl_hook.lua

@@ -15,6 +15,18 @@ local ytdl = {
 
 local chapter_list = {}
 
+function Set (t)
+    local set = {}
+    for _, v in pairs(t) do set[v] = true end
+    return set
+end
+
+local safe_protos = Set {
+    "http", "https", "ftp", "ftps",
+    "rtmp", "rtmps", "rtmpe", "rtmpt", "rtmpts", "rtmpte",
+    "data"
+}
+
 local function exec(args)
     local ret = utils.subprocess({args = args})
     return ret.status, ret.stdout, ret
@@ -71,6 +83,15 @@ local function edl_escape(url)
     return "%" .. string.len(url) .. "%" .. url
 end
 
+local function url_is_safe(url)
+    local proto = type(url) == "string" and url:match("^(.+)://") or nil
+    local safe = proto and safe_protos[proto]
+    if not safe then
+        msg.error(("Ignoring potentially unsafe url: '%s'"):format(url))
+    end
+    return safe
+end
+
 local function time_to_secs(time_string)
     local ret
 
@@ -182,6 +203,9 @@ local function edl_track_joined(fragments, protocol, is_live, base)
 
     for i = offset, #fragments do
         local fragment = fragments[i]
+        if not url_is_safe(join_url(base, fragment)) then
+            return nil
+        end
         table.insert(parts, edl_escape(join_url(base, fragment)))
         if fragment.duration then
             parts[#parts] =
@@ -201,6 +225,9 @@ local function add_single_video(json)
             edl_track = edl_track_joined(track.fragments,
                 track.protocol, json.is_live,
                 track.fragment_base_url)
+            if not edl_track and not url_is_safe(track.url) then
+                return
+            end
             if track.acodec and track.acodec ~= "none" then
                 -- audio track
                 mp.commandv("audio-add",
@@ -217,6 +244,9 @@ local function add_single_video(json)
         edl_track = edl_track_joined(json.fragments, json.protocol,
             json.is_live, json.fragment_base_url)
 
+        if not edl_track and not url_is_safe(json.url) then
+            return
+        end
         -- normal video or single track
         streamurl = edl_track or json.url
         set_http_headers(json.http_headers)
@@ -240,7 +270,8 @@ local function add_single_video(json)
 
             if not (sub_info.data == nil) then
                 sub = "memory://"..sub_info.data
-            elseif not (sub_info.url == nil) then
+            elseif not (sub_info.url == nil) and
+                url_is_safe(sub_info.url) then
                 sub = sub_info.url
             end
 
@@ -408,6 +439,10 @@ mp.add_hook("on_load", 10, function ()
 
                 msg.debug("EDL: " .. playlist)
 
+                if not playlist then
+                    return
+                end
+
                 -- can't change the http headers for each entry, so use the 1st
                 if json.entries[1] then
                     set_http_headers(json.entries[1].http_headers)
@@ -434,7 +469,8 @@ mp.add_hook("on_load", 10, function ()
                         local subfile = "edl://"
                         for i, entry in pairs(json.entries) do
                             if not (entry.requested_subtitles == nil) and
-                                not (entry.requested_subtitles[j] == nil) then
+                                not (entry.requested_subtitles[j] == nil) and
+                                url_is_safe(entry.requested_subtitles[j].url) then
                                 subfile = subfile..edl_escape(entry.requested_subtitles[j].url)
                             else
                                 subfile = subfile..edl_escape("memory://WEBVTT")
@@ -474,14 +510,17 @@ mp.add_hook("on_load", 10, function ()
                         site = entry["webpage_url"]
                     end
 
-                    if not (site:find("https?://") == 1) then
-                        site = "ytdl://" .. site
+                    -- links with only youtube id as returned by --flat-playlist
+                    if not site:find("://") then
+                        table.insert(playlist, "ytdl://" .. site)
+                    elseif url_is_safe(site) then
+                        table.insert(playlist, site)
                     end
-                    table.insert(playlist, site)
-
                 end
 
-                mp.set_property("stream-open-filename", "memory://" .. table.concat(playlist, "\n"))
+                if #playlist > 0 then
+                    mp.set_property("stream-open-filename", "memory://" .. table.concat(playlist, "\n"))
+                end
             end
 
         else -- probably a video