v0.2.18

CVE-2024-34064
CVE-2024-34069
CVE-2024-37891

README.md

@@ -151,7 +151,7 @@ For coding guidelines and an overview of the software architecture, see the [HAC
 
 yt-local is not made to work in public mode, however there is an instance of yt-local in public mode but with less features
 
-- <https://1cd1-93-95-230-133.ngrok-free.app/https://youtube.com>
+- <https://m.fridu.us/https://youtube.com>
 
 ## License
 

requirements-dev.txt

@@ -8,14 +8,14 @@ gevent==24.2.1
 greenlet==3.0.3
 iniconfig==2.0.0
 itsdangerous==2.1.2
-Jinja2==3.1.3
+Jinja2==3.1.4
 MarkupSafe==2.1.5
 packaging==24.0
 pluggy==1.4.0
 PySocks==1.7.1
 pytest==8.1.1
 stem==1.8.2
-urllib3==2.2.1
-Werkzeug==3.0.1
+urllib3==2.2.2
+Werkzeug==3.0.3
 zope.event==5.0
 zope.interface==6.2

requirements.txt

@@ -7,11 +7,11 @@ Flask==3.0.2
 gevent==24.2.1
 greenlet==3.0.3
 itsdangerous==2.1.2
-Jinja2==3.1.3
+Jinja2==3.1.4
 MarkupSafe==2.1.5
 PySocks==1.7.1
 stem==1.8.2
-urllib3==2.2.1
-Werkzeug==3.0.1
+urllib3==2.2.2
+Werkzeug==3.0.3
 zope.event==5.0
 zope.interface==6.2

youtube/static/channel.css

@@ -256,7 +256,8 @@ hr {
     padding-top: 6px;
     text-align: center;
     white-space: nowrap;
-    border: none;
+    border: 1px solid;
+    border-color: var(--button-border);
     border-radius: 0.2rem;
 }
 

youtube/static/dark_theme.css

@@ -1,20 +1,22 @@
 :root {
-    --background:           #212121;
+    --background:           #121113;
     --text:                 #FFFFFF;
-    --secondary-hover:      #73828c;
-    --secondary-focus:      #303030;
-    --secondary-inverse:    #FFF;
+    --secondary-hover:      #222222;
+    --secondary-focus:      #121113;
+    --secondary-inverse:    #FFFFFF;
     --primary-background:   #242424;
-    --secondary-background: #424242;
-    --thumb-background:     #757575;
+    --secondary-background: #222222;
+    --thumb-background:     #222222;
     --link:                 #00B0FF;
     --link-visited:         #40C4FF;
-    --border-bg:            #FFFFFF;
-    --buttom:               #dcdcdb;
-    --buttom-text:          #415462;
-    --button-border:        #91918c;
-    --buttom-hover:         #BBB;
-    --search-text:          #FFF;
-    --time-background:      #212121;
-    --time-text:            #FFF;
+    --border-bg:            #222222;
+    --border-bg-settings:   #000000;
+    --border-bg-license:    #000000;
+    --buttom:               #121113;
+    --buttom-text:          #FFFFFF;
+    --button-border:        #222222;
+    --buttom-hover:         #222222;
+    --search-text:          #FFFFFF;
+    --time-background:      #121113;
+    --time-text:            #FFFFFF;
 }

youtube/static/gray_theme.css

@@ -1,19 +1,21 @@
 :root {
-    --background:            #2d3743;
+    --background:            #2D3743;
     --text:                  #FFFFFF;
-    --secondary-hover:       #73828c;
+    --secondary-hover:       #73828C;
     --secondary-focus:       rgba(115, 130, 140, 0.125);
     --secondary-inverse:     #FFFFFF;
-    --primary-background:    #2d3743;
+    --primary-background:    #2D3743;
     --secondary-background:  #102027;
     --thumb-background:      #35404D;
-    --link:                  #22aaff;
-    --link-visited:          #7755ff;
+    --link:                  #22AAFF;
+    --link-visited:          #7755FF;
     --border-bg:             #FFFFFF;
-    --buttom:                #DCDCDC;
-    --buttom-text:           #415462;
-    --button-border:         #91918c;
-    --buttom-hover:          #BBBBBB;
+    --border-bg-settings:    #FFFFFF;
+    --border-bg-license:     #FFFFFF;
+    --buttom:                #2D3743;
+    --buttom-text:           #FFFFFF;
+    --button-border:         #102027;
+    --buttom-hover:          #102027;
     --search-text:           #FFFFFF;
     --time-background:       #212121;
     --time-text:             #FFFFFF;

youtube/static/license.css

@@ -181,7 +181,7 @@ label[for=options-toggle-cbox] {
 
 .table td,.table th {
     padding: 10px 10px;
-    border: 1px solid var(--secondary-background);
+    border: 1px solid var(--border-bg-license);
     text-align: center;
 }
 

youtube/static/light_theme.css

@@ -10,9 +10,11 @@
     --link:                 #212121;
     --link-visited:         #808080;
     --border-bg:            #212121;
-    --buttom:               #DCDCDC;
+    --border-bg-settings:   #91918C;
+    --border-bg-license:    #91918C;
+    --buttom:               #FFFFFF;
     --buttom-text:          #212121;
-    --button-border:        #91918c;
+    --button-border:        #91918C;
     --buttom-hover:         #BBBBBB;
     --search-text:          #212121;
     --time-background:      #212121;

youtube/static/settings.css

@@ -155,7 +155,7 @@ label[for=options-toggle-cbox] {
 }
 
 .settings-form > h2 {
-    border-bottom: 2px solid var(--border-bg);
+    border-bottom: 2px solid var(--border-bg-settings);
     padding-bottom: 0.5rem;
 }
 

youtube/util.py

@@ -431,34 +431,29 @@ class RateLimitedQueue(gevent.queue.Queue):
         gevent.queue.Queue.__init__(self)
 
     def get(self):
-        self.lock.acquire()     # blocks if another greenlet currently has the lock
-        if self.count_since_last_wait >= self.subsequent_bursts and self.surpassed_initial:
-            gevent.sleep(self.waiting_period)
-            self.count_since_last_wait = 0
-
-        elif self.count_since_last_wait >= self.initial_burst and not self.surpassed_initial:
-            self.surpassed_initial = True
-            gevent.sleep(self.waiting_period)
-            self.count_since_last_wait = 0
-
-        self.count_since_last_wait += 1
-
-        if not self.currently_empty and self.empty():
-            self.currently_empty = True
-            self.empty_start = time.monotonic()
-
-        item = gevent.queue.Queue.get(self)     # blocks when nothing left
-
-        if self.currently_empty:
-            if time.monotonic() - self.empty_start >= self.waiting_period:
+        with self.lock:     # blocks if another greenlet currently has the lock
+            if ((self.count_since_last_wait >= self.subsequent_bursts and self.surpassed_initial) or
+                (self.count_since_last_wait >= self.initial_burst and not self.surpassed_initial)):
+                self.surpassed_initial = True
+                gevent.sleep(self.waiting_period)
                 self.count_since_last_wait = 0
-                self.surpassed_initial = False
 
-            self.currently_empty = False
+            self.count_since_last_wait += 1
 
-        self.lock.release()
+            if not self.currently_empty and self.empty():
+                self.currently_empty = True
+                self.empty_start = time.monotonic()
 
-        return item
+            item = gevent.queue.Queue.get(self)     # blocks when nothing left
+
+            if self.currently_empty:
+                if time.monotonic() - self.empty_start >= self.waiting_period:
+                    self.count_since_last_wait = 0
+                    self.surpassed_initial = False
+
+                self.currently_empty = False
+
+            return item
 
 
 def download_thumbnail(save_directory, video_id):
@@ -667,19 +662,19 @@ def to_valid_filename(name):
 
 # https://github.com/yt-dlp/yt-dlp/blob/master/yt_dlp/extractor/youtube.py#L72
 INNERTUBE_CLIENTS = {
-    'android': {
+    'android-test-suite': {
         'INNERTUBE_API_KEY': 'AIzaSyA8eiZmM1FaDVjRy-df2KTyQ_vz_yYM39w',
         'INNERTUBE_CONTEXT': {
             'client': {
                 'hl': 'en',
                 'gl': 'US',
-                'clientName': 'ANDROID',
-                'clientVersion': '19.12.36',
+                'clientName': 'ANDROID_TESTSUITE',
+                'clientVersion': '1.9',
                 'osName': 'Android',
-                'osVersion': '14',
-                'androidSdkVersion': 34,
+                'osVersion': '12',
+                'androidSdkVersion': 31,
                 'platform': 'MOBILE',
-                'userAgent': 'com.google.android.youtube/19.12.36 (Linux; U; Android 14; US) gzip'
+                'userAgent': 'com.google.android.youtube/1.9 (Linux; U; Android 12; US) gzip'
             },
             # https://github.com/yt-dlp/yt-dlp/pull/575#issuecomment-887739287
             #'thirdParty': {
@@ -690,6 +685,60 @@ INNERTUBE_CLIENTS = {
         'REQUIRE_JS_PLAYER': False,
     },
 
+    'ios': {
+        'INNERTUBE_API_KEY': 'AIzaSyB-63vPrdThhKuerbB2N_l7Kwwcxj6yUAc',
+        'INNERTUBE_CONTEXT': {
+            'client': {
+                'hl': 'en',
+                'gl': 'US',
+                'clientName': 'IOS',
+                'clientVersion': '19.12.3',
+                'deviceModel': 'iPhone14,3',
+                'userAgent': 'com.google.ios.youtube/19.12.3 (iPhone14,3; U; CPU iOS 15_6 like Mac OS X)'
+            }
+        },
+        'INNERTUBE_CONTEXT_CLIENT_NAME': 5,
+        'REQUIRE_JS_PLAYER': False
+    },
+
+    'android': {
+        'INNERTUBE_API_KEY': 'AIzaSyA8eiZmM1FaDVjRy-df2KTyQ_vz_yYM39w',
+        'INNERTUBE_CONTEXT': {
+            'client': {
+                'hl': 'en',
+                'gl': 'US',
+                'clientName': 'ANDROID',
+                'clientVersion': '19.15.35',
+                'osName': 'Android',
+                'osVersion': '14',
+                'androidSdkVersion': 34,
+                'platform': 'MOBILE',
+                'userAgent': 'com.google.android.youtube/19.15.35 (Linux; U; Android 14; en_US; Google Pixel 6 Pro) gzip'
+            }
+        },
+        'INNERTUBE_CONTEXT_CLIENT_NAME': 3,
+        'REQUIRE_JS_PLAYER': False,
+    },
+
+    'android_music': {
+        'INNERTUBE_API_KEY': 'AIzaSyAOghZGza2MQSZkY_zfZ370N-PUdXEo8AI',
+        'INNERTUBE_CONTEXT': {
+            'client': {
+                'hl': 'en',
+                'gl': 'US',
+                'clientName': 'ANDROID_MUSIC',
+                'clientVersion': '6.48.51',
+                'osName': 'Android',
+                'osVersion': '14',
+                'androidSdkVersion': 34,
+                'platform': 'MOBILE',
+                'userAgent': 'com.google.android.apps.youtube.music/6.48.51 (Linux; U; Android 14; US) gzip'
+            }
+        },
+        'INNERTUBE_CONTEXT_CLIENT_NAME': 21,
+        'REQUIRE_JS_PLAYER': False
+    },
+
     # This client can access age restricted videos (unless the uploader has disabled the 'allow embedding' option)
     # See: https://github.com/zerodytrash/YouTube-Internal-Clients
     'tv_embedded': {

youtube/version.py

@@ -1,3 +1,3 @@
 from __future__ import unicode_literals
 
-__version__ = '0.2.11'
+__version__ = '0.2.18'

youtube/watch.py

@@ -2,6 +2,7 @@ import youtube
 from youtube import yt_app
 from youtube import util, comments, local_playlist, yt_data_extract
 from youtube.util import time_utc_isoformat
+from youtube.util import INNERTUBE_CLIENTS
 import settings
 
 from flask import request
@@ -343,7 +344,7 @@ def _add_to_error(info, key, additional_message):
 def fetch_player_response(client, video_id):
     return util.call_youtube_api(client, 'player', {
         'videoId': video_id,
-        'params': 'CgIQBg',
+        'params': 'CgIIAdgDAQ==',
     })
 
 
@@ -369,93 +370,83 @@ def fetch_watch_page_info(video_id, playlist_id, index):
     return yt_data_extract.extract_watch_info_from_html(watch_page)
 
 def extract_info(video_id, use_invidious, playlist_id=None, index=None):
-    tasks = (
-        # Get video metadata from here
-        gevent.spawn(fetch_watch_page_info, video_id, playlist_id, index),
+    for client in INNERTUBE_CLIENTS:
+        tasks = (
+            gevent.spawn(fetch_watch_page_info, video_id, playlist_id, index),
+            gevent.spawn(fetch_player_response, client, video_id)  # Use client from INNERTUBE_CLIENTS
+        )
+        gevent.joinall(tasks)
+        util.check_gevent_exceptions(*tasks)
+        info, player_response = tasks[0].value, tasks[1].value
 
-        # Get video URLs by spoofing as android client because its urls don't
-        # require decryption
-        # The URLs returned with WEB for videos requiring decryption
-        # couldn't be decrypted with the base.js from the web page for some
-        # reason
-        # https://github.com/yt-dlp/yt-dlp/issues/574#issuecomment-887171136
-
-        # Update 4/26/23, these URLs will randomly start returning 403
-        # mid-playback and I'm not sure why
-        gevent.spawn(fetch_player_response, 'android', video_id)
-    )
-    gevent.joinall(tasks)
-    util.check_gevent_exceptions(*tasks)
-    info, player_response = tasks[0].value, tasks[1].value
-
-    yt_data_extract.update_with_new_urls(info, player_response)
-
-    # Age restricted video, retry
-    if info['age_restricted'] or info['player_urls_missing']:
-        if info['age_restricted']:
-            print('Age restricted video, retrying')
-        else:
-            print('Player urls missing, retrying')
-        player_response = fetch_player_response('tv_embedded', video_id)
         yt_data_extract.update_with_new_urls(info, player_response)
 
-    # signature decryption
-    decryption_error = decrypt_signatures(info, video_id)
-    if decryption_error:
-        decryption_error = 'Error decrypting url signatures: ' + decryption_error
-        info['playability_error'] = decryption_error
+        # Age restricted video, retry
+        if info['age_restricted'] or info['player_urls_missing']:
+            if info['age_restricted']:
+                print('Age restricted video, retrying')
+            else:
+                print('Player urls missing, retrying')
+            player_response = fetch_player_response('tv_embedded', video_id)
+            yt_data_extract.update_with_new_urls(info, player_response)
 
-    # check if urls ready (non-live format) in former livestream
-    # urls not ready if all of them have no filesize
-    if info['was_live']:
-        info['urls_ready'] = False
-        for fmt in info['formats']:
-            if fmt['file_size'] is not None:
-                info['urls_ready'] = True
-    else:
-        info['urls_ready'] = True
+        # signature decryption
+        decryption_error = decrypt_signatures(info, video_id)
+        if decryption_error:
+            decryption_error = 'Error decrypting url signatures: ' + decryption_error
+            info['playability_error'] = decryption_error
 
-    # livestream urls
-    # sometimes only the livestream urls work soon after the livestream is over
-    if (info['hls_manifest_url']
-        and (info['live'] or not info['formats'] or not info['urls_ready'])
-    ):
-        manifest = util.fetch_url(info['hls_manifest_url'],
-            debug_name='hls_manifest.m3u8',
-            report_text='Fetched hls manifest'
-        ).decode('utf-8')
-
-        info['hls_formats'], err = yt_data_extract.extract_hls_formats(manifest)
-        if not err:
-            info['playability_error'] = None
-        for fmt in info['hls_formats']:
-            fmt['video_quality'] = video_quality_string(fmt)
-    else:
-        info['hls_formats'] = []
-
-    # check for 403. Unnecessary for tor video routing b/c ip address is same
-    info['invidious_used'] = False
-    info['invidious_reload_button'] = False
-    info['tor_bypass_used'] = False
-    if (settings.route_tor == 1
-            and info['formats'] and info['formats'][0]['url']):
-        try:
-            response = util.head(info['formats'][0]['url'],
-                                 report_text='Checked for URL access')
-        except urllib3.exceptions.HTTPError:
-            print('Error while checking for URL access:\n')
-            traceback.print_exc()
-            return info
-
-        if response.status == 403:
-            print('Access denied (403) for video urls.')
-            print('Routing video through Tor')
-            info['tor_bypass_used'] = True
+        # check if urls ready (non-live format) in former livestream
+        # urls not ready if all of them have no filesize
+        if info['was_live']:
+            info['urls_ready'] = False
             for fmt in info['formats']:
-                fmt['url'] += '&use_tor=1'
-        elif 300 <= response.status < 400:
-            print('Error: exceeded max redirects while checking video URL')
-    return info
+                if fmt['file_size'] is not None:
+                    info['urls_ready'] = True
+        else:
+            info['urls_ready'] = True
+
+        # livestream urls
+        # sometimes only the livestream urls work soon after the livestream is over
+        if (info['hls_manifest_url']
+            and (info['live'] or not info['formats'] or not info['urls_ready'])
+        ):
+            manifest = util.fetch_url(info['hls_manifest_url'],
+                debug_name='hls_manifest.m3u8',
+                report_text='Fetched hls manifest'
+            ).decode('utf-8')
+
+            info['hls_formats'], err = yt_data_extract.extract_hls_formats(manifest)
+            if not err:
+                info['playability_error'] = None
+            for fmt in info['hls_formats']:
+                fmt['video_quality'] = video_quality_string(fmt)
+        else:
+            info['hls_formats'] = []
+
+        # check for 403. Unnecessary for tor video routing b/c ip address is same
+        info['invidious_used'] = False
+        info['invidious_reload_button'] = False
+        info['tor_bypass_used'] = False
+        if (settings.route_tor == 1
+                and info['formats'] and info['formats'][0]['url']):
+            try:
+                response = util.head(info['formats'][0]['url'],
+                                     report_text='Checked for URL access')
+            except urllib3.exceptions.HTTPError:
+                print('Error while checking for URL access:\n')
+                traceback.print_exc()
+                return info
+
+            if response.status == 403:
+                print('Access denied (403) for video urls.')
+                print('Routing video through Tor')
+                info['tor_bypass_used'] = True
+                for fmt in info['formats']:
+                    fmt['url'] += '&use_tor=1'
+            elif 300 <= response.status < 400:
+                print('Error: exceeded max redirects while checking video URL')
+        return info
 
 
 def video_quality_string(format):