Expand description
The two things every libmpv handle in this process must get right before it is handed a URL.
Commands are an argument vector. The pinned libmpv crate’s
Mpv::command joins its arguments with spaces and hands the result to
mpv_command_string, which parses it as input.conf syntax: whitespace splits
arguments, ; separates commands, # starts a comment. Every URL this app
loads carries server-controlled text — item and media-source ids, the
server’s own TranscodingUrl, and for a download the file name, which is the
track title — so a title like x;run sh -c …;# ran a shell command the
moment it played. command goes through mpv_command instead, where each
argument reaches mpv as one opaque string and nothing is parsed.
TLS is verified. mpv’s tls-verify defaults to no, and the stream URLs
it loads carry the account’s ApiKey. Every reqwest client in the app
verifies certificates; without harden mpv was the one path where anyone
able to present a certificate for the server’s host could read the token.
ytdl goes with it: libmpv loads its youtube-dl hook by default and hands a
URL that failed to open — token included — to an external yt-dlp.
TRACES: UR-003, UR-004, UR-012 | DR-298, DR-299