Re: [FFmpeg-devel] [PATCH 2/3] avformat/imfdec: fail on probing non xml file extension

[Pierre-Anthony Lemieux <pal@sandflow.com>]

On Sun, May 7, 2023 at 12:18 PM Michael Niedermayer
<michael@niedermayer.cc> wrote:
>
> On Sat, May 06, 2023 at 11:01:20AM -0700, Pierre-Anthony Lemieux wrote:
> > On Sat, May 6, 2023 at 6:25 AM Michael Niedermayer
> > <michael@niedermayer.cc> wrote:
> > >
> > > Its unexpected that a .avi or other "standard" file turns into a playlist.
> > > The goal of this patch is to avoid this unexpected behavior and possible
> > > privacy or security differences.
> >
> > Per the IMF specification, a CPL can have any extension or, in fact,
> > no extension. The latter is routinely used.
>
> is there a restriction on the URL/URIs used in it ?
> that is in practice, can they be restricted to the same server,
> child directories, or some other restriction ?

Below is a brief overview of the linkage between the various of
components of an IMF composition:

- the Composition Playlist (CPL) is the file that is passed to FFMPEG
as input (-i)
- the CPL is an XML document and defines a playlist
- each of the components that make up the playlist is identified by a
UUID, i.e. the CPL does not contain file paths/URLs.
- the mapping between UUIDs and URLs is done through separate XML
files called Asset Maps. Paths to Asset Maps can be provided
explicitly through the "-assetmaps" argument, otherwise FFMPEG looks
for a file called "ASSETMAP.xml" in the same directory as the CPL
file.
- according to the standard, all URLs in each Asset Map is relative to
the location of the Asset Map, and thus the CPL and the Asset Map have
the same origin
- some applications have relaxed this constraint and allowed absolute
URLs in the Asset Map

What is the threat scenario? Is the concern that a malicious actor
provides a CPL and Asset Map from origin A that makes malicious
requests to a different origin B?

>
> thx
>
> [...]
> --
> Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB
>
> Breaking DRM is a little like attempting to break through a door even
> though the window is wide open and the only thing in the house is a bunch
> of things you dont want and which you would get tomorrow for free anyway
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".