From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id E350F46077 for ; Tue, 2 May 2023 20:57:26 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 73EE268B03F; Tue, 2 May 2023 23:57:23 +0300 (EEST) Received: from mail-ot1-f43.google.com (mail-ot1-f43.google.com [209.85.210.43]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id E34A468AF9E for ; Tue, 2 May 2023 23:57:16 +0300 (EEST) Received: by mail-ot1-f43.google.com with SMTP id 46e09a7af769-6a5ebf9f432so3040199a34.3 for ; Tue, 02 May 2023 13:57:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1683061034; x=1685653034; h=content-transfer-encoding:in-reply-to:from:references:to :content-language:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=GMgfTSwLd2/6gvBM6/+CZkK3tB0uOmc1wQJbApDP+x0=; b=CYiCFQVc3NiD2z7/xsBZVOPFfWe18kVb0mbIXLgqbMXYw6e/jM4Xcp63kFXRs9nQWU q3c1HRjENzRPM547ZUOm4uc4I5l3LqFr+gKj9ccQEYxR2arFmxWxUOFQEQd94Z+jiIL+ 5lchYm2lQhFlBdbrmCXfKVKcyUxONLEXjQYpDmND16N8EnK4JuKcq82sAUcefihQ4/TV O89MH9Mdpo9KnQuDC6CrnxlnNxQ5IbNOFNUMCZqPb6cpBtAfCr3VVd67YMPodJ7TxLWv uoctcgM2QjK7LoL/YuvSRsEg+0bSxmS8R+koHMWi3Z1W5aFiKJBNmjiVIDiWk7cN3OY8 8WqA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1683061034; x=1685653034; h=content-transfer-encoding:in-reply-to:from:references:to :content-language:subject:user-agent:mime-version:date:message-id :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=GMgfTSwLd2/6gvBM6/+CZkK3tB0uOmc1wQJbApDP+x0=; b=dNrO4GdhuSeAd2//8kpXKc6yLd/p4+PLSEtZ+TwW6hr1TbtSpBfNjWXsrm8y3tPc6O r3bjWazfc5YiH1n3V3Xkk+R5fzmjZxlKC7WByBfdVLb+uxMocRSlGxV4BvU/bpSzAXbr Tcu5LRRVb6x3ceTf+dJKufuhW+jvi0cp42Wu07iLCC9PAIGDL4iP5zEFKb/NpUAo4qHW Ciru+vmvgKa9zGJECsjctxvYqNtw0OKAtjnyu60HvmZz6Mi80ezO10sB+wr+YkpRI2Lw a/HyRjYY/7IWsMOPkz+7e6VdCrye1U0rotX9xhV5SfQWnfIPLsMd3z4XBfw74k6Aktm6 JCPw== X-Gm-Message-State: AC+VfDwODjTb9oamuPXkEX6kUCtaTAnCvhZ2x7n3A/62YZPT/7lvO9Na dCHtMPvYm8b+6SnQlNaXr72UYJ8Ayb4= X-Google-Smtp-Source: ACHHUZ63tHo3m9HoiQRtbOeer1E4xhZbZaGfzoqvrR1u5beBfIxZg/VkCDUN3z4I5pmvnRKtYM/ykQ== X-Received: by 2002:a05:6871:6ba1:b0:17a:cabc:c930 with SMTP id zh33-20020a0568716ba100b0017acabcc930mr8893294oab.4.1683061034384; Tue, 02 May 2023 13:57:14 -0700 (PDT) Received: from [192.168.0.15] (host197.190-225-105.telecom.net.ar. [190.225.105.197]) by smtp.gmail.com with ESMTPSA id i4-20020a056870864400b0018e996a507esm9537273oal.31.2023.05.02.13.57.12 for (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 02 May 2023 13:57:14 -0700 (PDT) Message-ID: Date: Tue, 2 May 2023 17:57:09 -0300 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Thunderbird/102.10.1 Content-Language: en-US To: ffmpeg-devel@ffmpeg.org References: <20230502193631.10844-1-michael@niedermayer.cc> <20230502201627.GA1391451@pb2> From: James Almer In-Reply-To: <20230502201627.GA1391451@pb2> Subject: Re: [FFmpeg-devel] [PATCH] [RFC] avformat: Add basic same origin check X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: On 5/2/2023 5:16 PM, Michael Niedermayer wrote: > On Tue, May 02, 2023 at 05:00:29PM -0300, James Almer wrote: >> On 5/2/2023 4:36 PM, Michael Niedermayer wrote: >>> TODO: bump minor version, add docs >>> >>> Signed-off-by: Michael Niedermayer >>> --- >>> libavformat/avformat.h | 10 ++++++++++ >>> libavformat/options.c | 29 +++++++++++++++++++++++++++++ >>> libavformat/options_table.h | 3 +++ >>> 3 files changed, 42 insertions(+) >>> >>> diff --git a/libavformat/avformat.h b/libavformat/avformat.h >>> index 1916aa2dc5..5ff77323ba 100644 >>> --- a/libavformat/avformat.h >>> +++ b/libavformat/avformat.h >>> @@ -1713,6 +1713,16 @@ typedef struct AVFormatContext { >>> * @return 0 on success, a negative AVERROR code on failure >>> */ >>> int (*io_close2)(struct AVFormatContext *s, AVIOContext *pb); >>> + >>> + /** >>> + * Perform basic same origin checks in default io_open() >>> + * - encoding: set by user >>> + * - decoding: set by user >>> + */ >>> + int same_origin_check; >>> +#define AVFMT_SAME_ORIGIN_CHECK_NONE 0 //no check >>> +#define AVFMT_SAME_ORIGIN_CHECK_HOST 1 //protocol, host, auth, port >>> +#define AVFMT_SAME_ORIGIN_CHECK_PATH 2 //protocol, host, auth, port, parent path >>> } AVFormatContext; >>> /** >>> diff --git a/libavformat/options.c b/libavformat/options.c >>> index e4a3aceed0..7db4bc9b38 100644 >>> --- a/libavformat/options.c >>> +++ b/libavformat/options.c >>> @@ -26,6 +26,7 @@ >>> #include "libavcodec/codec_par.h" >>> #include "libavutil/avassert.h" >>> +#include "libavutil/avstring.h" >>> #include "libavutil/internal.h" >>> #include "libavutil/intmath.h" >>> #include "libavutil/opt.h" >>> @@ -148,6 +149,34 @@ static int io_open_default(AVFormatContext *s, AVIOContext **pb, >>> av_log(s, loglevel, "Opening \'%s\' for %s\n", url, flags & AVIO_FLAG_WRITE ? "writing" : "reading"); >>> + if (s->same_origin_check) { >>> + URLComponents uc; >>> + int err; >>> + size_t len; >>> + const char *end; >>> + err = ff_url_decompose(&uc, s->url, NULL); >>> + if (err < 0) >>> + return err; >>> + >>> + if (s->same_origin_check == AVFMT_SAME_ORIGIN_CHECK_PATH) { >>> + end = uc.query; >>> + while (end > uc.path && *end != '/') >>> + end--; >>> + } else >>> + end = uc.path; >>> + >>> + len = end - s->url; >>> + if (strncmp(url, s->url, len)) { >>> + av_log(s, AV_LOG_ERROR, "Blocking url with differnt origin\n"); >>> + return AVERROR(EIO); >>> + } >>> + if (s->same_origin_check == AVFMT_SAME_ORIGIN_CHECK_PATH && >>> + av_strnstr(url + len, "/../", uc.query - end)) { >>> + av_log(s, AV_LOG_ERROR, "Blocking url tricks\n"); >>> + return AVERROR(EIO); >>> + } >>> + } >>> + >>> return ffio_open_whitelist(pb, url, flags, &s->interrupt_callback, options, s->protocol_whitelist, s->protocol_blacklist); >>> } >>> diff --git a/libavformat/options_table.h b/libavformat/options_table.h >>> index 86d836cfeb..da788164f1 100644 >>> --- a/libavformat/options_table.h >>> +++ b/libavformat/options_table.h >>> @@ -106,6 +106,9 @@ static const AVOption avformat_options[] = { >>> {"max_streams", "maximum number of streams", OFFSET(max_streams), AV_OPT_TYPE_INT, { .i64 = 1000 }, 0, INT_MAX, D }, >>> {"skip_estimate_duration_from_pts", "skip duration calculation in estimate_timings_from_pts", OFFSET(skip_estimate_duration_from_pts), AV_OPT_TYPE_BOOL, {.i64 = 0}, 0, 1, D}, >>> {"max_probe_packets", "Maximum number of packets to probe a codec", OFFSET(max_probe_packets), AV_OPT_TYPE_INT, { .i64 = 2500 }, 0, INT_MAX, D }, >>> +{"same_origin", "same origin check", OFFSET(same_origin_check) , AV_OPT_TYPE_INT , { .i64 = AVFMT_SAME_ORIGIN_CHECK_PATH }, 0, INT_MAX, D|E, "same_origin"}, >>> +{"same_host" , "same protocol, host, port, auth", 0 , AV_OPT_TYPE_CONST, { .i64 = AVFMT_SAME_ORIGIN_CHECK_HOST }, 0, INT_MAX, D|E, "same_origin"}, >>> +{"same_path" , "same protocol, host, port, auth, parent path", 0 , AV_OPT_TYPE_CONST, { .i64 = AVFMT_SAME_ORIGIN_CHECK_PATH }, 0, INT_MAX, D|E, "same_origin"}, >> >> Missing NONE const? > > added > +{"same_none" , "same origin check off" , 0 , AV_OPT_TYPE_CONST, { .i64 = AVFMT_SAME_ORIGIN_CHECK_NONE }, 0, INT_MAX, D|E, "same_origin"}, "none" sounds more natural. > > >> And do we want check_path to be default? It's a change >> in behavior. > > is it usefull if its not enabled by default ? It is, since it can be enabled, like the whitelists and blacklists, but the question is if it's preferable to have it enabled. If you consider it so, then it's good and i wont oppose it. > > > [...] > > > _______________________________________________ > ffmpeg-devel mailing list > ffmpeg-devel@ffmpeg.org > https://ffmpeg.org/mailman/listinfo/ffmpeg-devel > > To unsubscribe, visit link above, or email > ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".