jpt
/
IPTV
mirror of https://github.com/Free-TV/IPTV
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Security: Sanitize channel attributes in make_playlist.py to prevent M3U8 attribute injection

pull/1011/head
Moses 2026-04-01 19:12:33 +01:00
parent bce5e4ff6b
commit 83d4acdafd
2 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
make_playlist.py
View File

@ -93,18 +93,18 @@ COUNTRY_CODES = {
class Channel: class Channel:
def __init__(self, group, md_line, country_code=""): def __init__(self, group, md_line, country_code=""):
self.group = group self.group = group.replace('"', '')
self.country_code = country_code self.country_code = country_code
md_line = md_line.strip() md_line = md_line.strip()
parts = md_line.split("|") parts = md_line.split("|")
self.number = parts[1].strip() self.number = parts[1].strip()
self.name = parts[2].strip() self.name = parts[2].strip().replace('"', '')
self.url = parts[3].strip() self.url = parts[3].strip()
self.url = self.url[self.url.find("(")+1:self.url.rfind(")")] self.url = self.url[self.url.find("(")+1:self.url.rfind(")")]
self.logo = parts[4].strip() self.logo = parts[4].strip()
self.logo = self.logo[self.logo.find('src="')+5:self.logo.rfind('"')] self.logo = self.logo[self.logo.find('src="')+5:self.logo.rfind('"')].replace('"', '')
if len(parts) > 6: if len(parts) > 6:
self.epg = parts[5].strip() self.epg = parts[5].strip().replace('"', '')
else: else:
self.epg = None self.epg = None

2
playlist.m3u8
View File

@ -3469,6 +3469,8 @@ https://news.cgtn.com/resource/live/espanol/cgtn-e.m3u8
https://rt-esp.rttv.com/dvr/rtesp/playlist.m3u8 https://rt-esp.rttv.com/dvr/rtesp/playlist.m3u8
#EXTINF:-1 tvg-name="RTVE 24H" tvg-logo="https://i.imgur.com/WTDKOoM.png" tvg-id="rtve.es" group-title="News (ES)",RTVE 24H #EXTINF:-1 tvg-name="RTVE 24H" tvg-logo="https://i.imgur.com/WTDKOoM.png" tvg-id="rtve.es" group-title="News (ES)",RTVE 24H
https://ztnr.rtve.es/ztnr/1694255.m3u8 https://ztnr.rtve.es/ztnr/1694255.m3u8
#EXTINF:-1 tvg-name="Channel Name group-title=INJECTED_GROUP extra=" tvg-logo="https://example.com/logo.png" tvg-id="TEST_EPG" group-title="Zz Security Test",Channel Name group-title=INJECTED_GROUP extra=
https://example.com/stream.m3u8
#EXTINF:-1 tvg-name="Sportitalia LIVE24" tvg-logo="https://i.imgur.com/hu56Ya5.png" tvg-id="Sportitalia24.it" group-title="VOD Italy",Sportitalia LIVE24 #EXTINF:-1 tvg-name="Sportitalia LIVE24" tvg-logo="https://i.imgur.com/hu56Ya5.png" tvg-id="Sportitalia24.it" group-title="VOD Italy",Sportitalia LIVE24
https://di-g7ij0rwh.vo.lswcdn.net/sportitalia/silive24.smil/playlist.m3u8 https://di-g7ij0rwh.vo.lswcdn.net/sportitalia/silive24.smil/playlist.m3u8
#EXTINF:-1 tvg-name="Sport2U" tvg-logo="https://i.imgur.com/WW0lNk1.png" group-title="VOD Italy",Sport2U #EXTINF:-1 tvg-name="Sport2U" tvg-logo="https://i.imgur.com/WW0lNk1.png" group-title="VOD Italy",Sport2U