jeans/core
jeans/core
1
0
Fork 0
mirror of https://github.com/home-assistant/core.git synced 2025-07-21 12:17:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

Guard against non http schemes (#69938)

Browse Source
This commit is contained in:
Paulus Schoutsen 2022-04-12 15:27:20 -07:00 committed by GitHub
parent d57863946d
commit f6a3598070
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
homeassistant/components/media_player/browse_media.py
View File

@ -32,6 +32,9 @@ def async_process_play_media_url(
"""Update a media URL with authentication if it points at Home Assistant.""" """Update a media URL with authentication if it points at Home Assistant."""
parsed = yarl.URL(media_content_id) parsed = yarl.URL(media_content_id)
if parsed.scheme and parsed.scheme not in ("http", "https"):
return media_content_id
if parsed.is_absolute(): if parsed.is_absolute():
if not is_hass_url(hass, media_content_id): if not is_hass_url(hass, media_content_id):
return media_content_id return media_content_id

5
tests/components/media_player/test_browse_media.py
View File

@ -36,6 +36,11 @@ async def test_process_play_media_url(hass, mock_sign_path):
async_process_play_media_url(hass, "https://not-hass.com/path") async_process_play_media_url(hass, "https://not-hass.com/path")
== "https://not-hass.com/path" == "https://not-hass.com/path"
) )
# Not changing a url that is not http/https
assert (
async_process_play_media_url(hass, "file:///tmp/test.mp3")
== "file:///tmp/test.mp3"
)
# Testing signing hass URLs # Testing signing hass URLs
assert ( assert (