mac/apphub: remove mpv:// protocol handling

It has been moved to the mpv core with additional security
considerations, including filtering unsafe protocols from being opened
via the URL handler.

While we are not aware of any active exploitation, naive protocol
handling could allow the use of niche protocols in FFmpeg, which, in
turn, might load native code. How such native code would be dropped on
the local machine is another question.

This remains theoretical, but it's better to be safe than sorry.

Fixes: 494d408583
This commit is contained in:
Kacper Michajłow
2025-02-23 04:56:56 +01:00
parent 93ea3df0a9
commit 2799d8b130

View File

@@ -36,7 +36,6 @@ class AppHub: NSObject {
var cocoaCb: CocoaCB?
#endif
let MPV_PROTOCOL: String = "mpv://"
var isApplication: Bool { return NSApp is Application }
var isBundle: Bool { return ProcessInfo.processInfo.environment["MPVBUNDLE"] == "true" }
var openEvents: Int = 0
@@ -109,7 +108,6 @@ class AppHub: NSObject {
let files = urls.map {
if $0.isFileURL { return $0.path }
var path = $0.absoluteString
if path.hasPrefix(MPV_PROTOCOL) { path.removeFirst(MPV_PROTOCOL.count) }
return path.removingPercentEncoding ?? path
}.sorted { (strL: String, strR: String) -> Bool in
return strL.localizedStandardCompare(strR) == .orderedAscending