default to not using youtube-dl, for security

Pity, but same reasoning as curl applies to it.

This commit was sponsored by Peter on Patreon.

Annex/YoutubeDl.hs

@@ -1,6 +1,6 @@
 {- youtube-dl integration for git-annex
  -
- - Copyright 2017 Joey Hess <id@joeyh.name>
+ - Copyright 2017-2018 Joey Hess <id@joeyh.name>
  -
  - Licensed under the GNU GPL version 3 or higher.
  -}
@@ -27,6 +27,12 @@ import Logs.Transfer
 import Network.URI
 import Control.Concurrent.Async
 
+-- youtube-dl is can follow redirects to anywhere, including potentially
+-- localhost or a private address. So, it's only allowed to be used if the
+-- user has allowed access to all addresses.
+youtubeDlAllowed :: Annex Bool
+youtubeDlAllowed = httpAddressesUnlimited
+
 -- Runs youtube-dl in a work directory, to download a single media file
 -- from the url. Reutrns the path to the media file in the work directory.
 --
@@ -41,7 +47,10 @@ import Control.Concurrent.Async
 -- (Note that we can't use --output to specifiy the file to download to,
 -- due to <https://github.com/rg3/youtube-dl/issues/14864>)
 youtubeDl :: URLString -> FilePath -> Annex (Either String (Maybe FilePath))
-youtubeDl url workdir = withUrlOptions $ youtubeDl' url workdir
+youtubeDl url workdir = ifM httpAddressesUnlimited
+	( withUrlOptions $ youtubeDl' url workdir
+	, return (Right Nothing)
+	)
 
 youtubeDl' :: URLString -> FilePath -> UrlOptions -> Annex (Either String (Maybe FilePath))
 youtubeDl' url workdir uo
@@ -110,7 +119,13 @@ youtubeDlMaxSize workdir = ifM (Annex.getState Annex.force)
 
 -- Download a media file to a destination, 
 youtubeDlTo :: Key -> URLString -> FilePath -> Annex Bool
-youtubeDlTo key url dest = do
+youtubeDlTo key url dest = ifM youtubeDlAllowed
+	( youtubeDlTo' key url dest
+	, return False
+	)
+
+youtubeDlTo' :: Key -> URLString -> FilePath -> Annex Bool
+youtubeDlTo' key url dest = do
 	res <- withTmpWorkDir key $ \workdir ->
 		youtubeDl url workdir >>= \case
 			Right (Just mediafile) -> do
@@ -137,7 +152,10 @@ youtubeDlSupported url = either (const False) id <$> youtubeDlCheck url
 
 -- Check if youtube-dl can find media in an url.
 youtubeDlCheck :: URLString -> Annex (Either String Bool)
-youtubeDlCheck = withUrlOptions . youtubeDlCheck'
+youtubeDlCheck url = ifM youtubeDlAllowed
+	( withUrlOptions $ youtubeDlCheck' url
+	, return (Right False)
+	)
 
 youtubeDlCheck' :: URLString -> UrlOptions -> Annex (Either String Bool)
 youtubeDlCheck' url uo
@@ -150,7 +168,10 @@ youtubeDlCheck' url uo
 --
 -- (This is not always identical to the filename it uses when downloading.)
 youtubeDlFileName :: URLString -> Annex (Either String FilePath)
-youtubeDlFileName url = withUrlOptions go
+youtubeDlFileName url = ifM youtubeDlAllowed
+	( withUrlOptions go
+	, return nomedia
+	)
   where
 	go uo
 		| supportedScheme uo url = flip catchIO (pure . Left . show) $
@@ -161,7 +182,10 @@ youtubeDlFileName url = withUrlOptions go
 -- Does not check if the url contains htmlOnly; use when that's already
 -- been verified.
 youtubeDlFileNameHtmlOnly :: URLString -> Annex (Either String FilePath)
-youtubeDlFileNameHtmlOnly = withUrlOptions . youtubeDlFileNameHtmlOnly'
+youtubeDlFileNameHtmlOnly url = ifM youtubeDlAllowed
+	( withUrlOptions $ youtubeDlFileNameHtmlOnly' url
+	, return (Left "no media in url") 
+	)
 
 youtubeDlFileNameHtmlOnly' :: URLString -> UrlOptions -> Annex (Either String FilePath)
 youtubeDlFileNameHtmlOnly' url uo