Repository navigation
fix(media): let ffmpeg read only audio and video containers - #196
Merged
Merged
Conversation
ffmpeg picks a demuxer by content, not by extension, so an upload named clip.mp3 that was really an ffconcat list made it read another media file in the same folder. Every ffmpeg and ffprobe call on a file now passes a -format_whitelist of the containers Lens imports. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01W42z4FbekWr33b6791svQQ
3 of 8 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
6CFD
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Adeel · project thread
Description
Before: Lens checks only the file extension of an upload, but ffmpeg picks a demuxer from the file's content. Take a file named
clip.mp3whose content is an ffconcat list sayingfile secret.wav. ffprobe reportedformat_name=concat, and decoding returned the other file's audio, which would then be transcribed. A folder-scan import or a voice clip in/tmpcould reach whatever media sits next to it. HLS playlists were already refused by ffmpeg's own extension check.After: every ffmpeg and ffprobe call on a file (
ingest.probe,ingest.decode, and the four invideo.py) passes-format_whitelistwith the containers Lens imports (mp3, mov/mp4, wav, flac, ogg, aac, matroska/webm, amr, avi, asf, mpeg, mpegts, aiff). Playlists, concat lists and image sequences are refused.Motivation and Context
This answers threat-model question Q21: an upload that makes ffmpeg read another file is
VALIDunder P-NO-INJECTION.-protocol_whitelistwould not help, becausefile:is the protocol being abused. The whitelist also applies to inputs nested inside another one.Steps to reproduce (if appropriate):
test_ffmpeg_refuses_playlists_that_point_at_other_filesdecoded the neighbouring WAV on main and now raises. The video, voice, speech, encryption and import tests still pass locally. The full backend suite had one failure, in LibreOffice conversion, which fails the same way on main in this environment.Types of changes
!in the title)Checklist:
make hookschecks it on commit).docs/accordingly.## UnreleasedinCHANGELOG.md.🤖 Generated with Claude Code
https://claude.ai/code/session_01W42z4FbekWr33b6791svQQ
Generated by Claude Code