pax/booru-viewer
1
0
Fork 0
Code Issues Releases 18 Activity

security: fix #2 — set lavf options on _MpvGLWidget after construction

Browse Source 
Calls lavf_options() post mpv.MPV() init and writes each entry into
the demuxer-lavf-o property. This is the consumer side of the split
helpers introduced in the previous commit. Verified end-to-end by
launching the GUI: mpv constructs cleanly and m['demuxer-lavf-o']
reads back as {'protocol_whitelist': 'file,http,https,tls,tcp'}.

Audit-Ref: SECURITY_AUDIT.md finding #2
Severity: High
This commit is contained in:
pax 2026-04-11 16:34:57 -05:00
parent 4db7943ac7
commit 5858c274c8
1 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
booru_viewer/gui/media/mpv_gl.py
View File

@ -11,7 +11,7 @@ from PySide6.QtWidgets import QWidget, QVBoxLayout
import mpv as mpvlib import mpv as mpvlib
from ._mpv_options import build_mpv_kwargs from ._mpv_options import build_mpv_kwargs, lavf_options
log = logging.getLogger(__name__) log = logging.getLogger(__name__)
@ -42,11 +42,18 @@ class _MpvGLWidget(QWidget):
# for the full rationale). Summary: Discord screen-share audio # for the full rationale). Summary: Discord screen-share audio
# fix via `ao=pulse`, fast-load vd-lavc options, network cache # fix via `ao=pulse`, fast-load vd-lavc options, network cache
# tuning for the uncached-video fast path, and the SECURITY # tuning for the uncached-video fast path, and the SECURITY
# hardening from audit #2 (ytdl=no, load_scripts=no, # hardening from audit #2 (ytdl=no, load_scripts=no, POSIX
# demuxer_lavf_o protocol whitelist, POSIX input_conf null). # input_conf null).
self._mpv = mpvlib.MPV( self._mpv = mpvlib.MPV(
**build_mpv_kwargs(is_windows=sys.platform == "win32"), **build_mpv_kwargs(is_windows=sys.platform == "win32"),
) )
# The ffmpeg lavf demuxer protocol whitelist (also audit #2)
# has to be applied via the property API, not as an init
# kwarg — python-mpv's init path goes through
# mpv_set_option_string which trips on the comma-laden value.
# The property API uses the node API and accepts dict values.
for key, value in lavf_options().items():
self._mpv["demuxer-lavf-o"] = {key: value}
# Wire up the GL surface's callbacks to us # Wire up the GL surface's callbacks to us
self._gl._owner = self self._gl._owner = self