[FFmpeg-devel] [PATCH 2/2] avformat: add protocol_whitelist

[Andreas Cadhalpun]

On 24.01.2016 20:20, Nicolas George wrote:
> Le quintidi 5 pluviôse, an CCXXIV, Andreas Cadhalpun a écrit :
>> The idea is to classify protocols as local (file, concat) or remote (http, tcp).
> 
> I am sorry, but this is completely broken.

No. It would have prevented the issue with hls.

> First, concat is not local.

But it's usually only used with local files.

> Second, local/remote is not a relevant distinction for security.

Why not?

> Any design made with these assumptions at its code would be insecure.

How?

Best regards,
Andreas