Commit Graph
1 Commits
Author SHA1 Message Date
KAMI 794139f148 Security: sanitize channel attributes to prevent M3U8 attribute injection
group, name, logo and epg values are embedded unescaped into quoted
#EXTINF attributes (tvg-name, tvg-logo, tvg-id, group-title). A value
containing a double quote can break out of its attribute and inject
arbitrary extra attributes/content into the generated playlist.

Strip embedded double quotes from these fields at parse time.
2026-08-14 12:13:07 +02:00