search

bakape / thumbnailer

Go media thumbnailer
MIT License
153 stars 36 forks source link

Don't detect with FFmpeg if mp3 is not accepted #7

Closed Kagami closed 7 years ago

Kagami commented 7 years ago

Probing user-specified files with FFmpeg might be rather dangerous. For example if you pass it similar input:

#EXTM3U
#EXT-X-MEDIA-SEQUENCE:0
#EXTINF:10.0,
http://localhost:8000/1.mp4
#EXT-X-ENDLIST

it will make GET request to the specified URL which might be quite undesirable (e.g. consider website behind Cloudflare).

Of course it's not panacea, it might be still possible to come with header which would be accepted by DetectMIME() but cause some strange FFmpeg's demuxer behavior because we're calling avformat_open_input() when dumping frame anyway. So another improvement would be to pass desired demuxer from processVideo().

More details regarding FFmpeg's HLS handling: https://news.ycombinator.com/item?id=10893301

bakape commented 7 years ago

So you intend to give users the ability to opt out of the vulnerability? Fair enough.