[vlc-devel] [lua] Proposal for a standard-included playlist script...
remi at remlab.net
Mon Aug 13 14:02:14 CEST 2012
Le dimanche 12 août 2012 09:21:10 John Oyler, vous avez écrit :
> The script file would be named zzzzzzzz.lua so that it runs after
> everything else. The probe() function would (almost) always return
> true, so that if a valid http/https URL were input, this script would run.
The zzz... name only gets to run last within a given Lua scripts directory. It
does not ensure that:
- scripts from other directories, and
- other VLC demuxer plugins...
would run first.
> There are some gotchas:
> 1. Videolan doesn't seem to allow the dialog portion of the API from
> within a playlist. This would be needed to prompt the user to confirm
> that they wanted to install it.
Seriously, users _do_ not have the time and experience to review Lua scripts
for safety. Thus prompting the user is not an adequate approach.
> 2. Videolan doesn't seem to allow any filesystem access whatsoever.
Indirectly, it does, and it enables access to a number of other things that
untrusted scripts must not have access to. Currently, scripts are run only
from the local filesystem, and are all fully trusted.
Before scripts can be downloaded from the web (semi-)automatically, the whole
Lua API set needs to be reviewed and trimmed of sensitive and potentially
sensitive functionality. Also a mechanism is required to distinguish trusted
and untrusted scripts. Indeed some existing trusted playlist parsing scripts
already use sensitive functions (IIRC), and would otherwise break.
I had suggested such a review before VLC Lua extensions were shipped. But
nobody bothered. I guess it was too tedious, time-consuming and boring, while
not absolutely required for manually downloaded files. But for your purpose, I
think it would become absolutely required.
> I would like to work on a patch to Videolan that would add these (and
> other features) to the software, but
> I'm still digging through and trying to figure out what sort of build
> environment I'd need for that. If anyone
> can point me in the right direction for that, it would be appreciated.
I don't think anything particular is needed. Any normal VLC build environment
ought to work.
C/C++ software engineer looking for a job
More information about the vlc-devel