Avoid passing untrusted strings to the shell

engines/ct.py

@@ -139,7 +139,7 @@ def download(self, quality, movie):
         app = parsedurl.path[1:] + '?' + parsedurl.query
 
         # rtmpdump --live kvůli restartům - viz http://www.abclinuxu.cz/blog/pb/2011/5/televize-9-ctstream-3#18
-        return ('rtmp', filename, { 'url': base, 'playpath': src, 'app' : app, 'rtmpdump_args' : '--live'} )
+        return ('rtmp', filename, { 'url': base, 'playpath': src, 'app' : app, 'rtmpdump_args' : ['--live']} )
 
     def download_srt(self):
         if self.subtitles is None:

engines/dummy.py

@@ -22,7 +22,7 @@ def download(self, quality, movie):
         return ('rtmp', 'output.flv', {'url' : 'rtmp://server.net:port/appname/playpath',
                                        'playpath' : 'opravdu/divnej/playpath',
                                        'app' : 'opravdu/divná/aplikace',
-                                       'rtmpdump_args' : '--live',
+                                       'rtmpdump_args' : ['--live'],
                                        'token' : 'bezpečnostní_kód'} )
 
         return ('http', 'output.flv', {'url' : 'http://televize.tv/archiv/porad.flv' } )

engines/kraus.py

@@ -43,4 +43,4 @@ def download(self, quality, movie):
 
         filename = self.movielist[movie][2] if quality == 'low' else self.movielist[movie][1]
 
-        return ('rtmp', filename, {'url' : rtmp+'/'+filename, 'rtmpdump_args' : '--live'} )
+        return ('rtmp', filename, {'url' : rtmp+'/'+filename, 'rtmpdump_args' : ['--live']} )

engines/nova.py

@@ -93,5 +93,5 @@ def download(self, quality, movie):
 
         return ("rtmp", filename , { 'url' : baseUrl,
                                     'playpath' : playpath,
-                                    'rtmpdump_args' : '--live'})
+                                    'rtmpdump_args' : ['--live']})
 

engines/prima.py

@@ -90,7 +90,7 @@ def download_rtmp(self, quality):
             baseUrl = baseUrl.replace("token", "token_"+str(zoneGEO))
 
         return ("rtmp", playpath[:-3]+'flv' , { 'url' : baseUrl+'/'+playpath,
-                                     'rtmpdump_args' : '--live'})
+                                     'rtmpdump_args' : ['--live']})
 
     def download_cdn(self):
         cdnId = re.findall(r"cdnID=(\d+)", self.page)[0]

tv-dl

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 
-import argparse,os,sys,re,logging
+import argparse,os,sys,re,logging,subprocess
 
 class TVDownloader:
     def __init__(self, args):
@@ -70,35 +70,34 @@ class TVDownloader:
 
     @classmethod
     def download(cls, d, outfile):
-        cmd = ''
+        cmd = []
         if d[0] == 'rtmp':
-            args = ''
             parms = d[2]
+            cmd = ['rtmpdump', '-r', parms['url'], '-o', outfile]
             if 'playpath' in parms:
-                args += ' -y "{}"'.format(parms['playpath'])
+                cmd.extend(['-y', parms['playpath']])
 
             if 'app' in parms:
-                args += ' -a "{}"'.format(parms['app'])
+                cmd.extend(['-a', parms['app']])
 
             if 'token' in parms:
-                args += ' -T "{}"'.format(parms['token'])
+                cmd.extend(['-T', parms['token']])
 
             if 'rtmpdump_args' in parms:
-                args += ' '+parms['rtmpdump_args']
+                cmd.extend(parms['rtmpdump_args'])
 
-            cmd = 'rtmpdump -r "{}" -o "{}" {}'.format(parms['url'], outfile, args)
 
         elif d[0] == 'http':
-            cmd = 'wget -O "{}" "{}"'.format(d[1], d[2]['url'] )
+            cmd = ['wget', '-O', d[1], d[2]['url']]
 
         elif d[0] == "text":
             open(outfile, 'wb').write(d[2])
 
         else:
             raise ValueError("Nepodporovaný protokol: {}".format(d[0]) )
 
-        log.info('Příkaz: {}'.format(cmd))
-        os.system(cmd)
+        log.info('Příkaz: ' + ' '.join(cmd))
+        subprocess.call(cmd)
 
 
 if __name__ == "__main__":