From 2424f4de77385fc798f652a154a7a6ce8a3ca8e7 Mon Sep 17 00:00:00 2001 From: mykola2312 <49044616+mykola2312@users.noreply.github.com> Date: Mon, 26 Feb 2024 22:12:47 +0200 Subject: [PATCH] make spawn function accept slice of &str instead of generics so joining into string for logging is easy --- src/dl/ffmpeg.rs | 2 +- src/dl/spawn.rs | 12 +++++++----- src/dl/yt_dlp.rs | 4 ++-- 3 files changed, 10 insertions(+), 8 deletions(-) diff --git a/src/dl/ffmpeg.rs b/src/dl/ffmpeg.rs index dfb0454..33290fd 100644 --- a/src/dl/ffmpeg.rs +++ b/src/dl/ffmpeg.rs @@ -22,7 +22,7 @@ impl FFMpeg { let bitrate = format!("{}k", bitrate); let output = spawn( "ffmpeg", - [ + &[ "-i", input_path, "-codec:a", diff --git a/src/dl/spawn.rs b/src/dl/spawn.rs index 0c058fa..500dcc4 100644 --- a/src/dl/spawn.rs +++ b/src/dl/spawn.rs @@ -1,8 +1,8 @@ use core::fmt; -use std::ffi::OsStr; use std::process::Output; use std::str::Utf8Error; use tokio::process::Command; +use tracing::{event, Level}; #[derive(Debug)] pub enum SpawnError { @@ -36,11 +36,13 @@ impl fmt::Display for SpawnError { /* !!! The argument list could be exploited in a way to inject malicious arguments !!! !!! and alter the way program executes and/or gain access to system !!! */ -pub async fn spawn(program: &str, args: I) -> Result -where - I: IntoIterator, - S: AsRef, +pub async fn spawn(program: &str, args: &[&str]) -> Result { + { + let cmd_args = args.join(" "); + event!(Level::INFO, "{} {}", program, cmd_args); + } + let output = Command::new(program).args(args).output().await?; if !output.status.success() { diff --git a/src/dl/yt_dlp.rs b/src/dl/yt_dlp.rs index ce59326..3b811a8 100644 --- a/src/dl/yt_dlp.rs +++ b/src/dl/yt_dlp.rs @@ -170,7 +170,7 @@ pub struct YtDlp {} // BUG: REAL ARGUMENT INJECTION! FIX ASAP impl YtDlp { pub async fn load_info(url: &str) -> Result { - let output = spawn("python", ["-m", "yt_dlp", url, "-j"]).await?; + let output = spawn("python", &["-m", "yt_dlp", url, "-j"]).await?; Ok(YtDlpInfo::parse(&output.stdout)?) } @@ -178,7 +178,7 @@ impl YtDlp { pub async fn download(url: &str, format_id: &str, output_path: &str) -> Result<(), YtDlpError> { spawn( "python", - [ + &[ "-m", "yt_dlp", url,