[vlc-devel] [PATCH 2/3] vlm: print deprecation notice upon loading

[Rémi Denis-Courmont]

Le lauantaina 19. syyskuuta 2020, 21.36.20 EEST Alexandre Janniaux a écrit :
> > Even if we move away from the VLM, I think it could be good to still
> > offer support for all the existing *.vlm files out there, even if using
> > a different back end for it. And that can certainly be a helpful step.
> > But I'm not sure how to do it.
> 
> There's indeed security implications, but the case you describe needs
> a relatively free kind of arbitrary write on the FS to create the VLM
> configuration file that will gets parsed.

> In general, maybe we can add a kind of «redirection tracking» mechanism
> so that playlist leading to a VLM file are storing their origin so that
> we can prevent the VLM demux from opening?

That sounds a lot like the MSIE security zones, which Damien proposed way back 
as an alternative to the unsafe options. But it's actually really hard to 
track the origin, because there are all sorts of ways that a URL can be opened 
or redirected to.

> In more hacky way, we could add a `--enable-vlm` volatile option to
> prevent this from automatically happening while being able to enable
> it locally in the UI or other parts if the risk is serious.

If we want to retain compatibility, we need to keep the existing --vlm-conf 
command line option accepting a file path. Even if we could make the pair 
secure, a new demuxer and a new boolean option do seem like they would achieve 
that level of backward compatibility.


I believe that the means to do that with the least core code is this:

 if ((str = var_InheritString(vlc, "vlm-conf")) != NULL)
    libvlc_InternalAddIntf(vlc, "vlm,none"), free(str);

in the initialisation code. Then you can move all the VLM to a new interface 
module. This does notably not require a new module type. It also leaves open 
the possibility to provide an IPC within the VLM interface to send commands to 
a live VLM instance, if we deem this necessary.

-- 
Реми Дёни-Курмон
http://www.remlab.net/