On Tue, Feb 01, 2022 at 05:43:24PM +0100, Tomas Härdin wrote: > tis 2022-02-01 klockan 11:06 +0100 skrev Michael Niedermayer: > > On Mon, Jan 31, 2022 at 09:22:52PM +0100, Tomas Härdin wrote: > > [...] > > > It strikes me that this borders on incorporating business logic > > > within > > > lavf. A user could achieve the same thing with a small shell > > > script. > > > For example adding an alias that inspects calls to ffmpeg and sed:s > > > ipfs:// URLs accordingly > > > > That sounds like a security nightmare > > Parsing shit in C is a far bigger nightmare I can assure you. The > command line can leverage sed and the regex in the URL RFC.
the problem is if you parse it on the command line and change it before passing it to ffmpeg. You really need to have ffmpeg and the command line parse it 100% exactly the same. If theres a difference you can introduce security issues. because things in the commend line that are not intended to be changed by an attacker could become changeable by parser differences, this involves also issues with artgument seperators being parsed or not parsed as urls for example a filter argument could be a URL or it could be a generic string the command line wraper would have to know this difference. metadata and drawtext will behave interresting if they display ipfs: and keep in mind on top here the : is a argument seperator for filters so a real url ipfs link as filter argument would have the : escaped in some way. The command line tool would need to fully handle all escaping and unescping we use in every argument and it would need to have a list of what holds an url and what doesnt. Noone will implement this in a 100% correct form with sed and regex anyone trying will long before run naked through the streets and flap her/his hands as if (s)he is a chicken feel free to proof me wrong of course thx [...] -- Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB In fact, the RIAA has been known to suggest that students drop out of college or go to community college in order to be able to afford settlements. -- The RIAA
signature.asc
Description: PGP signature
_______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
