improve downloader/postprocessor module loading

- handle arguments of any type without propagating an exception
- prevent potential security risk through relative imports

gallery_dl/downloader/__init__.py

@@ -1,11 +1,13 @@
 # -*- coding: utf-8 -*-
 
-# Copyright 2015 Mike Fährmann
+# Copyright 2015-2018 Mike Fährmann
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 as
 # published by the Free Software Foundation.
 
+"""Downloader modules"""
+
 import importlib
 
 
@@ -14,13 +16,15 @@ def find(scheme):
     try:
         return _cache[scheme]
     except KeyError:
+        klass = None
         try:
-            module = importlib.import_module("."+scheme, __package__)
+            if "." not in scheme:  # prevent relative imports
-            klass = getattr(module, "Downloader")
+                module = importlib.import_module("." + scheme, __package__)
-            _cache[scheme] = klass
+                klass = module.Downloader
-            return klass
+        except (ImportError, AttributeError, TypeError):
-        except ImportError:
+            pass
-            return None
+        _cache[scheme] = klass
+        return klass
 
 
 # --------------------------------------------------------------------

gallery_dl/postprocessor/__init__.py

@@ -6,6 +6,8 @@
 # it under the terms of the GNU General Public License version 2 as
 # published by the Free Software Foundation.
 
+"""Post-processing modules"""
+
 import importlib
 import logging
 
@@ -17,13 +19,15 @@ def find(name):
     try:
         return _cache[name]
     except KeyError:
+        klass = None
         try:
-            module = importlib.import_module("."+name, __package__)
+            if "." not in name:  # prevent relative imports
-            cls = module.__postprocessor__
+                module = importlib.import_module("." + name, __package__)
-            _cache[name] = cls
+                klass = module.__postprocessor__
-            return cls
+        except (ImportError, AttributeError, TypeError):
-        except (ImportError, AttributeError):
+            pass
-            return None
+        _cache[name] = klass
+        return klass
 
 
 # --------------------------------------------------------------------