It has been moved to the mpv core with additional security considerations, including filtering unsafe protocols from being opened via the URL handler. While we are not aware of any active exploitation, naive protocol handling could allow the use of niche protocols in FFmpeg, which, in turn, might load native code. How such native code would be dropped on the local machine is another question. This remains theoretical, but it's better to be safe than sorry.
Unified · Split
| @@ -36,7 +36,6 @@ class AppHub: NSObject { · 35 unmodified lines | |||
| 36 | var cocoaCb: CocoaCB? | 36 | var cocoaCb: CocoaCB? |
| 37 | #endif | 37 | #endif |
| 38 | 38 | ||
| 39 | let MPV_PROTOCOL: String = "mpv://" | ||
| 40 | var isApplication: Bool { return NSApp is Application } | 39 | var isApplication: Bool { return NSApp is Application } |
| 41 | var isBundle: Bool { return ProcessInfo.processInfo.environment["MPVBUNDLE"] == "true" } | 40 | var isBundle: Bool { return ProcessInfo.processInfo.environment["MPVBUNDLE"] == "true" } |
| 42 | var openEvents: Int = 0 | 41 | var openEvents: Int = 0 |
| @@ -109,7 +108,6 @@ class AppHub: NSObject { · 66 unmodified lines | |||
| 109 | let files = urls.map { | 108 | let files = urls.map { |
| 110 | if $0.isFileURL { return $0.path } | 109 | if $0.isFileURL { return $0.path } |
| 111 | var path = $0.absoluteString | 110 | var path = $0.absoluteString |
| 112 | if path.hasPrefix(MPV_PROTOCOL) { path.removeFirst(MPV_PROTOCOL.count) } | ||
| 113 | return path.removingPercentEncoding ?? path | 111 | return path.removingPercentEncoding ?? path |
| 114 | }.sorted { (strL: String, strR: String) -> Bool in | 112 | }.sorted { (strL: String, strR: String) -> Bool in |
| 115 | return strL.localizedStandardCompare(strR) == .orderedAscending | 113 | return strL.localizedStandardCompare(strR) == .orderedAscending |