jpt
/
IPTV
mirror of https://github.com/Free-TV/IPTV
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Security: sanitize channel attributes to prevent M3U8 attribute injection 

group, name, logo and epg values are embedded unescaped into quoted
#EXTINF attributes (tvg-name, tvg-logo, tvg-id, group-title). A value
containing a double quote can break out of its attribute and inject
arbitrary extra attributes/content into the generated playlist.

Strip embedded double quotes from these fields at parse time.
pull/1124/head
KAMI 2026-08-14 12:13:07 +02:00
parent 87ecbc9224
commit 794139f148
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
make_playlist.py
View File

@ -96,21 +96,21 @@ class Channel: # pylint: disable=too-few-public-methods,too-many-instance-attri
"""A single channel entry parsed from a markdown list line.""" """A single channel entry parsed from a markdown list line."""
def __init__(self, group, md_line, country_code=""): def __init__(self, group, md_line, country_code=""):
self.group = group self.group = group.replace('"', '')
self.country_code = country_code self.country_code = country_code
md_line = md_line.strip() md_line = md_line.strip()
parts = md_line.split("|") parts = md_line.split("|")
self.number = parts[1].strip() self.number = parts[1].strip()
self.name = parts[2].strip() self.name = parts[2].strip().replace('"', '')
self.url = parts[3].strip() self.url = parts[3].strip()
self.url = self.url[self.url.find("(")+1:self.url.rfind(")")] self.url = self.url[self.url.find("(")+1:self.url.rfind(")")]
self.logo = parts[4].strip() self.logo = parts[4].strip()
self.logo = self.logo[self.logo.find('src="')+5:self.logo.rfind('"')] self.logo = self.logo[self.logo.find('src="')+5:self.logo.rfind('"')].replace('"', '')
self.chno = self.number if self.number and self.number != "0" else None self.chno = self.number if self.number and self.number != "0" else None
if len(parts) > 6: if len(parts) > 6:
self.epg = parts[5].strip() self.epg = parts[5].strip().replace('"', '')
else: else:
self.epg = None self.epg = None