It has been moved to the mpv core with additional security considerations, including filtering unsafe protocols from being opened via the URL handler. While we are not aware of any active exploitation, naive protocol handling could allow the use of niche protocols in FFmpeg, which, in turn, might load native code. How such native code would be dropped on the local machine is another question. This remains theoretical, but it's better to be safe than sorry.
Unified · Split
| @@ -36,7 +36,6 @@ class AppHub: NSObject { · 35 unmodified lines | ||
| 36 | 36 | var cocoaCb: CocoaCB? |
| 37 | 37 | #endif |
| 38 | 38 | |
| 39 | − let MPV_PROTOCOL: String = "mpv://" | |
| 40 | 39 | var isApplication: Bool { return NSApp is Application } |
| 41 | 40 | var isBundle: Bool { return ProcessInfo.processInfo.environment["MPVBUNDLE"] == "true" } |
| 42 | 41 | var openEvents: Int = 0 |
| @@ -109,7 +108,6 @@ class AppHub: NSObject { · 66 unmodified lines | ||
| 109 | 108 | let files = urls.map { |
| 110 | 109 | if $0.isFileURL { return $0.path } |
| 111 | 110 | var path = $0.absoluteString |
| 112 | − if path.hasPrefix(MPV_PROTOCOL) { path.removeFirst(MPV_PROTOCOL.count) } | |
| 113 | 111 | return path.removingPercentEncoding ?? path |
| 114 | 112 | }.sorted { (strL: String, strR: String) -> Bool in |
| 115 | 113 | return strL.localizedStandardCompare(strR) == .orderedAscending |