jellytau_lib/player/

mpv_command.rs

//! The two things every libmpv handle in this process must get right before it
//! is handed a URL.
//!
//! **Commands are an argument vector.** The pinned `libmpv` crate's
//! `Mpv::command` joins its arguments with spaces and hands the result to
//! `mpv_command_string`, which parses it as input.conf syntax: whitespace splits
//! arguments, `;` separates commands, `#` starts a comment. Every URL this app
//! loads carries server-controlled text — item and media-source ids, the
//! server's own `TranscodingUrl`, and for a download the file name, which is the
//! track title — so a title like `x;run sh -c …;#` ran a shell command the
//! moment it played. [`command`] goes through `mpv_command` instead, where each
//! argument reaches mpv as one opaque string and nothing is parsed.
//!
//! **TLS is verified.** mpv's `tls-verify` defaults to *no*, and the stream URLs
//! it loads carry the account's `ApiKey`. Every reqwest client in the app
//! verifies certificates; without [`harden`] mpv was the one path where anyone
//! able to present a certificate for the server's host could read the token.
//! `ytdl` goes with it: libmpv loads its youtube-dl hook by default and hands a
//! URL that failed to open — token included — to an external `yt-dlp`.
//!
//! TRACES: UR-003, UR-004, UR-012 | DR-298, DR-299

use std::ffi::{CStr, CString};
use std::os::raw::c_char;

use libmpv::Mpv;

/// Run an mpv command with each argument passed through verbatim.
///
/// TRACES: UR-003, UR-004 | DR-298 | UT-268
pub fn command(mpv: &Mpv, args: &[&str]) -> Result<(), String> {
    if args.is_empty() {
        return Err("empty mpv command".to_string());
    }
    // A NUL cannot be represented in a C string; refusing is the only honest
    // answer, since truncating would load a different URL than the one asked.
    let owned = args
        .iter()
        .map(|a| CString::new(*a).map_err(|_| format!("mpv argument contains NUL: {a:?}")))
        .collect::<Result<Vec<_>, _>>()?;
    let mut argv: Vec<*const c_char> = owned.iter().map(|a| a.as_ptr()).collect();
    argv.push(std::ptr::null());

    // SAFETY: `argv` is a NULL-terminated array of pointers into `owned`, which
    // outlives the call; mpv copies what it keeps. `ctx` is the live handle.
    let rc = unsafe { libmpv_sys::mpv_command(mpv.ctx.as_ptr(), argv.as_mut_ptr()) };
    if rc < 0 {
        // SAFETY: mpv_error_string returns a static string for any code.
        let msg = unsafe { CStr::from_ptr(libmpv_sys::mpv_error_string(rc)) };
        return Err(format!("{} ({rc})", msg.to_string_lossy()));
    }
    Ok(())
}

/// Configure a freshly created handle so it will not trust an unverified server.
///
/// Must run before the first `loadfile`. Failure is an error, not a warning: a
/// handle that could not be told to verify TLS is exactly the one that leaks.
///
/// TRACES: UR-012 | DR-299 | UT-270
pub fn harden(mpv: &Mpv) -> Result<(), String> {
    for (name, value) in [("tls-verify", "yes"), ("ytdl", "no")] {
        mpv.set_property(name, value)
            .map_err(|e| format!("could not set {name}={value}: {e:?}"))?;
    }
    Ok(())
}

#[cfg(test)]
mod tests {
    use super::*;

    /// A handle that decodes nothing and opens no device, so the tests need no
    /// audio system and no display.
    fn null_mpv() -> Mpv {
        let mpv = Mpv::new().expect("libmpv must be available to run the player tests");
        mpv.set_property("ao", "null").unwrap();
        mpv.set_property("vo", "null").unwrap();
        mpv
    }

    /// The injection itself, against a real libmpv: a URL carrying `;` and a
    /// second command must be loaded as one (unreachable) URL, not split and
    /// executed. `set volume 13` stands in for `run …` — the same parse, but
    /// observable without spawning a process.
    ///
    /// TRACES: UR-003, UR-004 | DR-298 | UT-268
    #[test]
    fn a_url_cannot_smuggle_a_second_mpv_command() {
        let mpv = null_mpv();
        mpv.set_property("volume", 100i64).unwrap();

        // Port 9 (discard) on loopback: nothing is fetched either way.
        let url = "http://127.0.0.1:9/Audio/x;set volume 13;#/stream?ApiKey=k";
        let _ = command(&mpv, &["loadfile", url, "replace"]);

        let volume: i64 = mpv.get_property("volume").unwrap();
        assert_eq!(
            volume, 100,
            "text inside a URL was executed as an mpv command"
        );
    }

    /// An argument with a space in it — every downloaded title with one —
    /// arrives as one argument rather than being split into the next slot.
    ///
    /// TRACES: UR-003, UR-004 | DR-298 | UT-268
    #[test]
    fn an_argument_with_spaces_stays_one_argument() {
        let mpv = null_mpv();
        // Split on the space this would be `loadfile file:///tmp/My Song.mp3`
        // — `Song.mp3` taken as the flags argument, which mpv rejects.
        assert!(command(&mpv, &["loadfile", "file:///nonexistent/My Song.mp3"]).is_ok());
    }

    /// No playback path may call the string-joining `Mpv::command` directly;
    /// they all go through [`command`]. Asserted against the source because the
    /// dangerous call and the safe one have the same shape at the call site.
    ///
    /// TRACES: UR-003, UR-004 | DR-298 | UT-269
    #[test]
    fn players_never_use_the_string_command_api() {
        for (file, src) in [
            ("mpv_backend.rs", include_str!("mpv_backend.rs")),
            ("mpv_player.rs", include_str!("mpv_player.rs")),
        ] {
            assert!(
                !src.contains(".command(\""),
                "{file} calls Mpv::command, which parses its arguments as a command string"
            );
        }
    }

    /// TRACES: UR-012 | DR-299 | UT-270
    #[test]
    fn a_hardened_handle_verifies_tls_and_never_hands_urls_to_ytdl() {
        let mpv = null_mpv();
        harden(&mpv).unwrap();

        let tls: String = mpv.get_property("tls-verify").unwrap();
        assert_eq!(tls, "yes");
        let ytdl: String = mpv.get_property("ytdl").unwrap();
        assert_eq!(ytdl, "no");
    }

    /// Both constructors apply [`harden`]; a handle built without it is the bug.
    ///
    /// TRACES: UR-012 | DR-299 | UT-270
    #[test]
    fn every_player_hardens_its_handle() {
        for (file, src) in [
            ("mpv_backend.rs", include_str!("mpv_backend.rs")),
            ("mpv_player.rs", include_str!("mpv_player.rs")),
        ] {
            assert!(
                src.contains("mpv_command::harden(&mpv)"),
                "{file} creates an mpv handle without hardening it"
            );
        }
    }
}