[vlc-devel] [PATCH 2/2] playlist/fetcher: do not ignore metadata scope when downloading art

[Filip Roséen]

Hi Pierre,

On 2016-12-10 01:08, Pierre Ynard wrote:

> > Previously the implementation would unconditionally download art,
> > these changes make sure that we respect the scope of the fetcher being
> > used.
> 
> Does this mean that the Art URL returned by any lua playlist script
> suddenly gets ignored? There will be complaints about that, and it
> hardly makes sense since typical scripts parse a web page resulting from
> deliberate network access, and are allowed by design to make secondary
> network requests to fetch the media URL and other metadata.

It will be "ignored" if the user has specified
`--no-metadata-network-access` and the URL for the art specified is
not considered "local" (see previous discussion with *Remi* for
further information on the matteR).

I cannot see any other way to interpret the flag, and the intent has
always been to block metadata lookup and access for the desribed set
of entities (when the flag is enabled).

> I agree that privacy leaks are to be taken seriously, but even in the
> M3U example, you could argue the appropriate and intuitive behavior is
> to still download the art, if the URL of the main media and/or of the
> M3U is already on the network.

The `m3u`-example is simply an example, the same would happen for
entities that has a remote resource embedded directly within the
media; the reason I choose `m3u` to demonstrate the issue is that it
is easily edited, and easily reasoned about.
 
> I don't know well enough the playlist and art code to make
> recommendations, but I'll suggest to adjust the scope flags if the
> original request already has a larger scope than the metadata setting;
> or maybe just a check comparing the URL protocols would be an easy way
> to offer a lot of functionality.

The option, `--no-metadata-network-access`, is there to precisely do
what the name implies; to not fetch metadata (such as artwork) over
the network.

Best Regards,\
Filip Roséen
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.videolan.org/pipermail/vlc-devel/attachments/20161210/038b7e80/attachment.html>