From f6a359807020e96fa6172440decc3aee34063c7b Mon Sep 17 00:00:00 2001 From: Paulus Schoutsen Date: Tue, 12 Apr 2022 15:27:20 -0700 Subject: [PATCH] Guard against non http schemes (#69938) --- homeassistant/components/media_player/browse_media.py | 3 +++ tests/components/media_player/test_browse_media.py | 5 +++++ 2 files changed, 8 insertions(+) diff --git a/homeassistant/components/media_player/browse_media.py b/homeassistant/components/media_player/browse_media.py index e4cad5c3201..60234cd1b38 100644 --- a/homeassistant/components/media_player/browse_media.py +++ b/homeassistant/components/media_player/browse_media.py @@ -32,6 +32,9 @@ def async_process_play_media_url( """Update a media URL with authentication if it points at Home Assistant.""" parsed = yarl.URL(media_content_id) + if parsed.scheme and parsed.scheme not in ("http", "https"): + return media_content_id + if parsed.is_absolute(): if not is_hass_url(hass, media_content_id): return media_content_id diff --git a/tests/components/media_player/test_browse_media.py b/tests/components/media_player/test_browse_media.py index 6741432024e..ea1e3b4fc36 100644 --- a/tests/components/media_player/test_browse_media.py +++ b/tests/components/media_player/test_browse_media.py @@ -36,6 +36,11 @@ async def test_process_play_media_url(hass, mock_sign_path): async_process_play_media_url(hass, "https://not-hass.com/path") == "https://not-hass.com/path" ) + # Not changing a url that is not http/https + assert ( + async_process_play_media_url(hass, "file:///tmp/test.mp3") + == "file:///tmp/test.mp3" + ) # Testing signing hass URLs assert (