Disable the generic extractor entirely

It can be used for SSRF attacks even when redirects are disabled
bblinder · Mar 8, 2022 · 8913f27 · 8913f27
1 parent 148a171
commit 8913f27
Show file tree

Hide file tree

Showing 4 changed files with 18 additions and 18 deletions.
diff --git a/composer.json b/composer.json
@@ -78,7 +78,7 @@
     ],
     "patches": {
       "ytdl-org/youtube-dl": {
-        "Disable redirects in generic extractor": "patches/youtube-dl-redirect.diff"
+        "Disable the generic extractor": "patches/youtube-dl-disable-generic.diff"
       }
     }
   },

diff --git a/composer.lock b/composer.lock
diff --git a/patches/youtube-dl-disable-generic.diff b/patches/youtube-dl-disable-generic.diff
@@ -0,0 +1,12 @@
+diff --git a/youtube_dl/extractor/__init__.py b/youtube_dl/extractor/__init__.py
+index 18d8dbcd6..4d3edfac3 100644
+--- a/youtube_dl/extractor/__init__.py
++++ b/youtube_dl/extractor/__init__.py
+@@ -13,7 +13,6 @@ except ImportError:
+         for name, klass in globals().items()
+         if name.endswith('IE') and name != 'GenericIE'
+     ]
+-    _ALL_CLASSES.append(GenericIE)
+
+
+ def gen_extractor_classes():
diff --git a/patches/youtube-dl-redirect.diff b/patches/youtube-dl-redirect.diff