gnu/packages/patches/mpv-CVE-2018-6360-1.patch

   1 Fix CVE-2018-6360:
   2
   3 https://github.com/mpv-player/mpv/issues/5456
   4 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6360
   5 https://security-tracker.debian.org/tracker/CVE-2018-6360
   6
   7 Patch copied from upstream source repository:
   8
   9 https://github.com/mpv-player/mpv/commit/e6e6b0dcc7e9b0dbf35154a179b3dc1fcfcaff43
  10
  11 To apply the patch to mpv 0.28.0 release tarball, hunk #4 is removed. Hunk #4
  12 checks if 'mpd_url' is safe, but the support for 'mpd_url' is not available
  13 for the 0.28.0 release. So it should be safe to remove hunk #4.
  14
  15 From e6e6b0dcc7e9b0dbf35154a179b3dc1fcfcaff43 Mon Sep 17 00:00:00 2001
  16 From: Ricardo Constantino <wiiaboo@gmail.com>
  17 Date: Fri, 26 Jan 2018 01:19:04 +0000
  18 Subject: [PATCH] ytdl_hook: whitelist protocols from urls retrieved from
  19  youtube-dl
  20
  21 Not very clean since there's a lot of potential unsafe urls that youtube-dl
  22 can give us, depending on whether it's a single url, split tracks,
  23 playlists, segmented dash, etc.
  24 ---
  25  player/lua/ytdl_hook.lua | 54 +++++++++++++++++++++++++++++++++++++++++-------
  26  1 file changed, 47 insertions(+), 7 deletions(-)
  27
  28 diff --git a/player/lua/ytdl_hook.lua b/player/lua/ytdl_hook.lua
  29 index dd96ecc01d..b480c21625 100644
  30 --- a/player/lua/ytdl_hook.lua
  31 +++ b/player/lua/ytdl_hook.lua
  32 @@ -16,6 +16,18 @@ local ytdl = {
  33
  34  local chapter_list = {}
  35
  36 +function Set (t)
  37 +    local set = {}
  38 +    for _, v in pairs(t) do set[v] = true end
  39 +    return set
  40 +end
  41 +
  42 +local safe_protos = Set {
  43 +    "http", "https", "ftp", "ftps",
  44 +    "rtmp", "rtmps", "rtmpe", "rtmpt", "rtmpts", "rtmpte",
  45 +    "data"
  46 +}
  47 +
  48  local function exec(args)
  49      local ret = utils.subprocess({args = args})
  50      return ret.status, ret.stdout, ret
  51 @@ -183,6 +195,9 @@ local function edl_track_joined(fragments, protocol, is_live, base)
  52
  53      for i = offset, #fragments do
  54          local fragment = fragments[i]
  55 +        if not url_is_safe(join_url(base, fragment)) then
  56 +            return nil
  57 +        end
  58          table.insert(parts, edl_escape(join_url(base, fragment)))
  59          if fragment.duration then
  60              parts[#parts] =
  61 @@ -208,6 +223,15 @@ local function proto_is_dash(json)
  62             or json["protocol"] == "http_dash_segments"
  63  end
  64
  65 +local function url_is_safe(url)
  66 +    local proto = type(url) == "string" and url:match("^(.+)://") or nil
  67 +    local safe = proto and safe_protos[proto]
  68 +    if not safe then
  69 +        msg.error(("Ignoring potentially unsafe url: '%s'"):format(url))
  70 +    end
  71 +    return safe
  72 +end
  73 +
  74  local function add_single_video(json)
  75      local streamurl = ""
  76      local max_bitrate = 0
  77 @@ -238,14 +264,18 @@ local function add_single_video(json)
  78              edl_track = edl_track_joined(track.fragments,
  79                  track.protocol, json.is_live,
  80                  track.fragment_base_url)
  81 +            local url = edl_track or track.url
  82 +            if not url_is_safe(url) then
  83 +                return
  84 +            end
  85              if track.acodec and track.acodec ~= "none" then
  86                  -- audio track
  87                  mp.commandv("audio-add",
  88 -                    edl_track or track.url, "auto",
  89 +                    url, "auto",
  90                      track.format_note or "")
  91              elseif track.vcodec and track.vcodec ~= "none" then
  92                  -- video track
  93 -                streamurl = edl_track or track.url
  94 +                streamurl = url
  95              end
  96          end
  97
  98 @@ -264,7 +294,13 @@ local function add_single_video(json)
  99
 100      msg.debug("streamurl: " .. streamurl)
 101
 102 -    mp.set_property("stream-open-filename", streamurl:gsub("^data:", "data://", 1))
 103 +    streamurl = streamurl:gsub("^data:", "data://", 1)
 104 +
 105 +    if not url_is_safe(streamurl) then
 106 +        return
 107 +    end
 108 +
 109 +    mp.set_property("stream-open-filename", streamurl)
 110
 111      mp.set_property("file-local-options/force-media-title", json.title)
 112
 113 @@ -526,14 +562,18 @@ mp.add_hook(o.try_ytdl_first and "on_load" or "on_load_fail", 10, function ()
 114                          site = entry["webpage_url"]
 115                      end
 116
 117 -                    if not (site:find("https?://") == 1) then
 118 -                        site = "ytdl://" .. site
 119 +                    -- links with only youtube id as returned by --flat-playlist
 120 +                    if not site:find("://") then
 121 +                        table.insert(playlist, "ytdl://" .. site)
 122 +                    elseif url_is_safe(site) then
 123 +                        table.insert(playlist, site)
 124                      end
 125 -                    table.insert(playlist, site)
 126
 127                  end
 128
 129 -                mp.set_property("stream-open-filename", "memory://" .. table.concat(playlist, "\n"))
 130 +                if #playlist > 0 then
 131 +                    mp.set_property("stream-open-filename", "memory://" .. table.concat(playlist, "\n"))
 132 +                end
 133              end
 134
 135          else -- probably a video
 136 --
 137 2.16.1
 138