Repository navigation
Conversation
The video URL was appended as a bare positional argument, so a caller-supplied value shaped like "--plugin-dirs=<dir>" was parsed as a flag: it re-enabled the plugin search --no-plugin-dirs had just disabled and ran Python code from a caller-named directory. Exported downloadVideo also trusted its caller to have run isVideoUrl. Assert the link is http/https inside downloadVideo and pass it behind a "--" end-of-options separator. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.
SanHsien
added a commit
to SanHsien/hypit
that referenced
this pull request
Oct 28, 2026
Port of upstream PR hypit-ai#444 (issue hypit-ai#452, head d137a53); the diff does not apply to this fork's base, so the design is ported. downloadVideo passed the caller's link as the last yt-dlp argument with no `--`, so a link such as `--plugin-dirs=<dir>` was parsed as an option and could run Python code from that directory. Validate the link with isVideoUrl first and put it behind `--`. The new tests failed before the fix (the option-shaped link reached the environment check) and pass after. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
SanHsien
added a commit
to SanHsien/hypit
that referenced
this pull request
Oct 28, 2026
…i#447-hypit-ai#456; advance watermarks PRs hypit-ai#442, hypit-ai#443 and hypit-ai#444 were ported ahead of upstream (d5afdfe, 541ab59, 5dc763c) because the fork has the same defect and it is reachable from outside input. The rest are recorded with the fork-side evidence and a re-review trigger in docs/fork/DECISIONS.md. Release track unchanged at v0.3.1; watermarks PR 455, issue 456. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #452
Summary
downloadVideoinpackages/yt-dlp/src/download.tsappended the URL as a bare positional argument with no--separator, and the exported function trusted its caller to have runisVideoUrl. A value shaped like--plugin-dirs=<dir>was parsed by yt-dlp as an option: it re-enabled the plugin search that--no-plugin-dirshad just disabled, loading and running Python code from a caller-named directory. Other option-shaped values (--exec,--paths,--config) were similarly injectable.downloadVideoassertsisVideoUrlitself (http/https only — the same rule the CLI layer applied) and passes the link behind a literal--end-of-options separator. The existing option set (--ignore-config,--no-plugin-dirs,--no-remote-components, …) is unchanged.Behavior relative to main
downloadVideo("https://…/v", t)--)downloadVideo("--plugin-dirs=/tmp/evil", t)must be an http or https URLdownloadVideo("file:///etc/passwd", t)must be an http or https URLRed / green
packages/yt-dlp/test/download.test.ts: the mocked-execFile test now assertsargs.at(-2) === "--"before the link (fails on main — link wasargs.at(-1)with no separator), plus a new test asserting option-shaped andfile:links reject before the environment is even probed.Verification
node --import tsx --test packages/yt-dlp/test/download.test.ts— 6 pass.pnpm check— clean.Merge Danger
downloadVideonow rejects non-URL input itself; callers relying on it to pass through arbitrary strings (none in-repo) get an error.Checklist
Generated with Devin