Important
Update to 2.0.0 immediately
A RCE vulnerability (GHSA-qpv9-8xfj-xx9m) was disclosed by @gamer191, and affects users of the server method using the default 0.0.0.0 server binding. It allows an attacker to perform a man-in-the-middle attack to execute arbitrary code on the machine via a maliciously crafted request from a local network device, or if a maliciously crafted website is clicked (on older browser versions, see security advisory for details).
Caution
Breaking Change: The HTTP server no longer binds to 0.0.0.0 by default, and binds to localhost. This is a breaking change for any use case requiring communication with other devices on the local network. We expect this to be a no-op for most people running the server natively.
For Docker users, please note the updated command to ensure that only localhost requests are able to access the server container:
docker run --name bgutil-provider -d --init -p 127.0.0.1:4416:4416 brainicism/bgutil-ytdlp-pot-provider
What's Changed
- [server] Server now binds to localhost rather than 0.0.0.0
- [server] Various security fixes
- [server] Fix issue with Deno server connectivity on Windows devices with dual IP stack enabled
Commits
- [docker] Use loopback for published provider port by @Brainicism in #262
- [server] Block PAC proxy schemes by @Brainicism in #260
- [server] Require application/json for /get_pot by @Brainicism in #259
- [server] Reject browser-originated requests by @Brainicism in #258
- [server] Bind HTTP server to localhost by default by @Brainicism in #257
- [server] require json for request body by @grqz in #255
- [server] disable axios' builtin proxy to fix HTTPS_PROXY for node<22.21 or 24.5 by @grqz in #254
- [ci] Avoid SIGPIPE flake in script method test by @Brainicism in #250
- [server] Bind IPv6 and IPv4 wildcards as separate sockets (fixes #244) by @Brainicism in #249
Full Changelog: 1.3.2...2.0.0
