From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id 88B2545536 for ; Tue, 2 May 2023 20:00:45 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 7993668C132; Tue, 2 May 2023 23:00:42 +0300 (EEST) Received: from mail-oa1-f42.google.com (mail-oa1-f42.google.com [209.85.160.42]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 58F5B68BF70 for ; Tue, 2 May 2023 23:00:35 +0300 (EEST) Received: by mail-oa1-f42.google.com with SMTP id 586e51a60fabf-1929d8c009cso228408fac.2 for ; Tue, 02 May 2023 13:00:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1683057633; x=1685649633; h=content-transfer-encoding:in-reply-to:from:content-language :references:to:subject:user-agent:mime-version:date:message-id:from :to:cc:subject:date:message-id:reply-to; bh=9MQsBqLzJuMvZjG0WdTivM18HCqwcx9wnb5c0KlK0oc=; b=nozTLOTC5OPtkN5fTgCsBLI/UnldyFH/GvugsMOxATyUKe/Taet65Lv26SbmVtdc28 tKKyRXzX/Kdga6cBwQ273NI8LKdT3mH9BPuqdGC9l47qM3+5FjGdwT29wOmKIkQQOyjS lAM+ctaHMkzJ71sdoIfhNuPXwXcjKm/+OLmaDBNs9W0EKBhqwyxsGpmNytCAcleJPKmm XsAEqxDdVAfXVWf+WLw16CMOlXE8vOZYOUXfk6XpUUac5XYso14rqRDj2Na+Nf4RBr8S uqu2826CMZPJfNC8/xmKH+tfi5q0qf+kZKR0IwEUrqPUg9QSumCZl1kARpVqKjHOVLzd ZSGg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1683057633; x=1685649633; h=content-transfer-encoding:in-reply-to:from:content-language :references:to:subject:user-agent:mime-version:date:message-id :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=9MQsBqLzJuMvZjG0WdTivM18HCqwcx9wnb5c0KlK0oc=; b=eRG3R1EZVCU70ztPcEz0DiXpt2a/HsCqNRbHs4ySt/F9u4Z1k7InX7MxVrEzHai+Wd 4kXlNuCo4YGPedmNMwEgGWtM1BwKACp2Nn/CqCx8IBaX1CaDOuDYRRJ1vcW/rf+qv+uf Z/My5pwchTHBzPlCo+9exo+AzzE0qILVWxCMH9l14oYQRguf8FlW+Oci0KKM+yVsEixi OCjdFwIBD/6Ns5YY6vQDHI4KwGm0tWr/DoCJUSR26oOJYbUKGEEVoCjg0sM2+tUhFo1G aXNzqcPGOOamaP3qFUdqWF8Mfxr+pMtEjShqB2KwSIEXnc7HzvwXZUuhRbsMTkjOq7rm ifhA== X-Gm-Message-State: AC+VfDwJ2FWT8ncYQQ98A/7VgL6KXp5Z7b6QWLvaVhsHgf85aYOXUuEE veXFM3yK50ScqR4Pka1JBUoNLFi4icA= X-Google-Smtp-Source: ACHHUZ5ApP++/JjZWGGVuBFH3qNvevEvCPi+DEzyFjI4EcYEk2nN8EIS51VTF+L2MMDIjVOniMhf9A== X-Received: by 2002:a05:6870:8803:b0:180:5d12:64e6 with SMTP id n3-20020a056870880300b001805d1264e6mr9998967oam.49.1683057632680; Tue, 02 May 2023 13:00:32 -0700 (PDT) Received: from [192.168.0.15] (host197.190-225-105.telecom.net.ar. [190.225.105.197]) by smtp.gmail.com with ESMTPSA id u36-20020a05687004e400b0017f647294f5sm12666580oam.16.2023.05.02.13.00.31 for (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 02 May 2023 13:00:32 -0700 (PDT) Message-ID: Date: Tue, 2 May 2023 17:00:29 -0300 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Thunderbird/102.10.1 To: ffmpeg-devel@ffmpeg.org References: <20230502193631.10844-1-michael@niedermayer.cc> Content-Language: en-US From: James Almer In-Reply-To: <20230502193631.10844-1-michael@niedermayer.cc> Subject: Re: [FFmpeg-devel] [PATCH] [RFC] avformat: Add basic same origin check X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: On 5/2/2023 4:36 PM, Michael Niedermayer wrote: > TODO: bump minor version, add docs > > Signed-off-by: Michael Niedermayer > --- > libavformat/avformat.h | 10 ++++++++++ > libavformat/options.c | 29 +++++++++++++++++++++++++++++ > libavformat/options_table.h | 3 +++ > 3 files changed, 42 insertions(+) > > diff --git a/libavformat/avformat.h b/libavformat/avformat.h > index 1916aa2dc5..5ff77323ba 100644 > --- a/libavformat/avformat.h > +++ b/libavformat/avformat.h > @@ -1713,6 +1713,16 @@ typedef struct AVFormatContext { > * @return 0 on success, a negative AVERROR code on failure > */ > int (*io_close2)(struct AVFormatContext *s, AVIOContext *pb); > + > + /** > + * Perform basic same origin checks in default io_open() > + * - encoding: set by user > + * - decoding: set by user > + */ > + int same_origin_check; > +#define AVFMT_SAME_ORIGIN_CHECK_NONE 0 //no check > +#define AVFMT_SAME_ORIGIN_CHECK_HOST 1 //protocol, host, auth, port > +#define AVFMT_SAME_ORIGIN_CHECK_PATH 2 //protocol, host, auth, port, parent path > } AVFormatContext; > > /** > diff --git a/libavformat/options.c b/libavformat/options.c > index e4a3aceed0..7db4bc9b38 100644 > --- a/libavformat/options.c > +++ b/libavformat/options.c > @@ -26,6 +26,7 @@ > #include "libavcodec/codec_par.h" > > #include "libavutil/avassert.h" > +#include "libavutil/avstring.h" > #include "libavutil/internal.h" > #include "libavutil/intmath.h" > #include "libavutil/opt.h" > @@ -148,6 +149,34 @@ static int io_open_default(AVFormatContext *s, AVIOContext **pb, > > av_log(s, loglevel, "Opening \'%s\' for %s\n", url, flags & AVIO_FLAG_WRITE ? "writing" : "reading"); > > + if (s->same_origin_check) { > + URLComponents uc; > + int err; > + size_t len; > + const char *end; > + err = ff_url_decompose(&uc, s->url, NULL); > + if (err < 0) > + return err; > + > + if (s->same_origin_check == AVFMT_SAME_ORIGIN_CHECK_PATH) { > + end = uc.query; > + while (end > uc.path && *end != '/') > + end--; > + } else > + end = uc.path; > + > + len = end - s->url; > + if (strncmp(url, s->url, len)) { > + av_log(s, AV_LOG_ERROR, "Blocking url with differnt origin\n"); > + return AVERROR(EIO); > + } > + if (s->same_origin_check == AVFMT_SAME_ORIGIN_CHECK_PATH && > + av_strnstr(url + len, "/../", uc.query - end)) { > + av_log(s, AV_LOG_ERROR, "Blocking url tricks\n"); > + return AVERROR(EIO); > + } > + } > + > return ffio_open_whitelist(pb, url, flags, &s->interrupt_callback, options, s->protocol_whitelist, s->protocol_blacklist); > } > > diff --git a/libavformat/options_table.h b/libavformat/options_table.h > index 86d836cfeb..da788164f1 100644 > --- a/libavformat/options_table.h > +++ b/libavformat/options_table.h > @@ -106,6 +106,9 @@ static const AVOption avformat_options[] = { > {"max_streams", "maximum number of streams", OFFSET(max_streams), AV_OPT_TYPE_INT, { .i64 = 1000 }, 0, INT_MAX, D }, > {"skip_estimate_duration_from_pts", "skip duration calculation in estimate_timings_from_pts", OFFSET(skip_estimate_duration_from_pts), AV_OPT_TYPE_BOOL, {.i64 = 0}, 0, 1, D}, > {"max_probe_packets", "Maximum number of packets to probe a codec", OFFSET(max_probe_packets), AV_OPT_TYPE_INT, { .i64 = 2500 }, 0, INT_MAX, D }, > +{"same_origin", "same origin check", OFFSET(same_origin_check) , AV_OPT_TYPE_INT , { .i64 = AVFMT_SAME_ORIGIN_CHECK_PATH }, 0, INT_MAX, D|E, "same_origin"}, > +{"same_host" , "same protocol, host, port, auth", 0 , AV_OPT_TYPE_CONST, { .i64 = AVFMT_SAME_ORIGIN_CHECK_HOST }, 0, INT_MAX, D|E, "same_origin"}, > +{"same_path" , "same protocol, host, port, auth, parent path", 0 , AV_OPT_TYPE_CONST, { .i64 = AVFMT_SAME_ORIGIN_CHECK_PATH }, 0, INT_MAX, D|E, "same_origin"}, Missing NONE const? And do we want check_path to be default? It's a change in behavior. > {NULL}, > }; > _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".