From 5176eb2db8732dcd340cfe9de2284613294b017f Mon Sep 17 00:00:00 2001 From: KAMI Date: Fri, 14 Aug 2026 12:13:49 +0200 Subject: [PATCH] Security: sanitize channel attributes to prevent M3U8 attribute injection (#1124) group, name, logo and epg values are embedded unescaped into quoted #EXTINF attributes (tvg-name, tvg-logo, tvg-id, group-title). A value containing a double quote can break out of its attribute and inject arbitrary extra attributes/content into the generated playlist. Strip embedded double quotes from these fields at parse time. Co-authored-by: KAMI --- make_playlist.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/make_playlist.py b/make_playlist.py index 83b60ba..ff0496a 100755 --- a/make_playlist.py +++ b/make_playlist.py @@ -96,21 +96,21 @@ class Channel: # pylint: disable=too-few-public-methods,too-many-instance-attri """A single channel entry parsed from a markdown list line.""" def __init__(self, group, md_line, country_code=""): - self.group = group + self.group = group.replace('"', '') self.country_code = country_code md_line = md_line.strip() parts = md_line.split("|") self.number = parts[1].strip() - self.name = parts[2].strip() + self.name = parts[2].strip().replace('"', '') self.url = parts[3].strip() self.url = self.url[self.url.find("(")+1:self.url.rfind(")")] self.logo = parts[4].strip() - self.logo = self.logo[self.logo.find('src="')+5:self.logo.rfind('"')] + self.logo = self.logo[self.logo.find('src="')+5:self.logo.rfind('"')].replace('"', '') self.chno = self.number if self.number and self.number != "0" else None if len(parts) > 6: - self.epg = parts[5].strip() + self.epg = parts[5].strip().replace('"', '') else: self.epg = None