pvharmo2/gha-lab-2f775f277cAuthorized lab reproduction of CVE-2025-47928 (spotipy-dev/spotipy pull_request_target secrets exfiltration) — snapshot at vulnerable commit 4f5759d
Automated research artifact — not the upstream project.
This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of
spotipy-dev/spotipyat commit4f5759dbfb4506c7b6280572a4db1aabc1ac778d(2025-04-21), redistributed under that project's own licence, whose file is included unchanged in this snapshot.The upstream project is not involved, is never targeted, and the vulnerability studied here is already public. Every secret and variable in this repository is a randomly generated dummy value — no real credential is present. Action references and runner images are pinned to what they resolved to on 2025-04-21; see
pinning.mdin the harness output for every change made to the snapshot.Questions or objections: [email protected]
Spotipy supports all of the features of the Spotify Web API including access to all end points, and support for user authorization. For details on the capabilities you are encouraged to review the Spotify Web API documentation.
pip install spotipy
alternatively, for Windows users
py -m pip install spotipy
or upgrade
pip install spotipy --upgrade
A full set of examples can be found in the online documentation and in the Spotipy examples directory.
To get started, install spotipy, create a new account or log in on https://developers.spotify.com/. Go to the dashboard, create an app and add your new ID and SECRET (ID and SECRET can be found on an app setting) to your environment:
import spotipy
from spotipy.oauth2 import SpotifyClientCredentials
sp = spotipy.Spotify(auth_manager=SpotifyClientCredentials(client_id="YOUR_APP_CLIENT_ID",
client_secret="YOUR_APP_CLIENT_SECRET"))
results = sp.search(q='weezer', limit=20)
for idx, track in enumerate(results['tracks']['items']):
print(idx, track['name'])
Expected result:
0 Island In The Sun
1 Say It Ain't So
2 Buddy Holly
.
.
.
18 Troublemaker
19 Feels Like Summer
A redirect URI must be added to your application at My Dashboard to access user authenticated features.
import spotipy
from spotipy.oauth2 import SpotifyOAuth
sp = spotipy.Spotify(auth_manager=SpotifyOAuth(client_id="YOUR_APP_CLIENT_ID",
client_secret="YOUR_APP_CLIENT_SECRET",
redirect_uri="YOUR_APP_REDIRECT_URI",
scope="user-library-read"))
results = sp.current_user_saved_tracks()
for idx, item in enumerate(results['items']):
track = item['track']
print(idx, track['artists'][0]['name'], " – ", track['name'])
Expected result will be the list of music that you liked. For example if you liked Red and Sunflower, the result will be:
0 Post Malone – Sunflower - Spider-Man: Into the Spider-Verse
1 Taylor Swift – Red
For common questions please check our FAQ.
You can ask questions about Spotipy on Stack Overflow. Don’t forget to add the Spotipy tag, and any other relevant tags as well, before posting.
If you have suggestions, bugs or other issues specific to this library, file them here. Or just send a pull request.
If you are a developer with Python experience, and you would like to contribute to Spotipy, please be sure to follow the guidelines listed on documentation page