test(audio): opt-in live ffprobe check on hostile playlists and real audio

Skipped unless TAPIR_LIVE_FFPROBE is set. Synthetic/crafted files only.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/adapters/audio/ffmpeg.go

@@ -27,8 +27,10 @@ func (f *FFmpeg) ToWAV(ctx context.Context, src, dst string) error {
 	if bin == "" {
 		bin = "ffmpeg"
 	}
-	cmd := exec.CommandContext(ctx, bin,
+	// Input restrictions go BEFORE -i: placed after it they would apply to the output.
-		"-y", "-v", "error", "-i", src, "-vn", "-ac", "1", "-ar", "16000", "-c:a", "pcm_s16le", "-f", "wav", dst)
+	args := append([]string{"-y", "-v", "error"}, inputRestrictions...)
+	args = append(args, "-i", src, "-vn", "-ac", "1", "-ar", "16000", "-c:a", "pcm_s16le", "-f", "wav", dst)
+	cmd := exec.CommandContext(ctx, bin, args...)
 	cmd.WaitDelay = killGrace
 	if out, err := cmd.CombinedOutput(); err != nil {
 		if ctxErr := ctx.Err(); ctxErr != nil {

internal/adapters/audio/ffmpeg_test.go

@@ -58,3 +58,22 @@ func TestFFmpegToWAV_MissingBinaryIsAnError(t *testing.T) {
 	require.Error(t, err)
 	assert.False(t, errors.Is(err, context.Canceled))
 }
+
+func TestFFmpegToWAV_RestrictsWhatTheFileMayMakeFFmpegOpen(t *testing.T) {
+	rec := filepath.Join(t.TempDir(), "argv")
+	bin := stub(t, `printf '%s\n' "$@" > `+rec+`
+for a; do last="$a"; done
+printf data > "$last"`)
+
+	err := (&audio.FFmpeg{Bin: bin}).ToWAV(context.Background(), "/spool/in", filepath.Join(t.TempDir(), "o.wav"))
+
+	require.NoError(t, err)
+	args := argvOf(t, rec)
+	pw, fw, in := indexOf(args, "-protocol_whitelist"), indexOf(args, "-format_whitelist"), indexOf(args, "-i")
+	require.GreaterOrEqual(t, pw, 0, "argv: %v", args)
+	require.GreaterOrEqual(t, fw, 0, "argv: %v", args)
+	assert.Equal(t, "file,pipe", args[pw+1])
+	assert.Equal(t, audio.AllowedDemuxers, args[fw+1])
+	assert.Less(t, pw, in, "input options must come BEFORE -i or ffmpeg applies them to the output")
+	assert.Less(t, fw, in)
+}

internal/adapters/audio/ffprobe.go

@@ -21,6 +21,19 @@ type FFprobe struct {
 	Bin string
 }
 
+// AllowedDemuxers are the input formats an upload may be. The input is
+// attacker-supplied, and a file's CONTENT can tell ffmpeg to open other files or
+// URLs (HLS and concat playlists, image2 sequences, network demuxers). Recent
+// ffmpeg refuses the ones tried (7.0.2: HLS without a .m3u8 name is not sniffed,
+// concat rejects unsafe paths), but that is version luck; this list is not. It
+// holds the containers real recordings use and none of the playlist or network
+// formats. "mov" covers .mp4/.m4a/.3gp; "matroska" covers .webm.
+const AllowedDemuxers = "wav,mov,mp4,m4a,3gp,mp3,ogg,matroska,webm,flac,aac,opus,aiff,amr,asf"
+
+// inputRestrictions are ffmpeg/ffprobe INPUT options and must precede the input.
+// Local files and pipes only: no network, no other protocols.
+var inputRestrictions = []string{"-protocol_whitelist", "file,pipe", "-format_whitelist", AllowedDemuxers}
+
 // killGrace bounds how long Probe waits for a cancelled ffprobe's pipes to close.
 const killGrace = 2 * time.Second
 
@@ -34,8 +47,9 @@ func (f *FFprobe) Probe(ctx context.Context, path string) (uploads.Probe, error)
 	if bin == "" {
 		bin = "ffprobe"
 	}
-	cmd := exec.CommandContext(ctx, bin,
+	args := append([]string{"-v", "error"}, inputRestrictions...)
-		"-v", "error", "-print_format", "json", "-show_format", "-show_streams", path)
+	args = append(args, "-print_format", "json", "-show_format", "-show_streams", path)
+	cmd := exec.CommandContext(ctx, bin, args...)
 	cmd.WaitDelay = killGrace
 	out, err := cmd.Output()
 	if err != nil {

internal/adapters/audio/ffprobe_test.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 	"time"
 
@@ -127,3 +128,59 @@ func TestFFprobeProbe_StopsWhenTheContextIsCancelled(t *testing.T) {
 	assert.Less(t, time.Since(start), 5*time.Second)
 	assert.False(t, errors.Is(err, uploads.ErrUnreadable), "a timeout is not a verdict on the file")
 }
+
+// argvStub records the arguments it was called with into a file and then behaves as
+// a successful ffprobe, so a test can assert exactly what the process was asked.
+func argvStub(t *testing.T) (bin, argvFile string) {
+	t.Helper()
+	argvFile = filepath.Join(t.TempDir(), "argv")
+	bin = stub(t, `printf '%s\n' "$@" > `+argvFile+`
+echo '{"streams":[{"codec_type":"audio"}],"format":{"duration":"1"}}'`)
+	return bin, argvFile
+}
+
+func argvOf(t *testing.T, file string) []string {
+	t.Helper()
+	raw, err := os.ReadFile(file)
+	require.NoError(t, err)
+	return strings.Split(strings.TrimSpace(string(raw)), "\n")
+}
+
+func indexOf(args []string, want string) int {
+	for i, a := range args {
+		if a == want {
+			return i
+		}
+	}
+	return -1
+}
+
+func TestFFprobeProbe_RestrictsWhatTheFileMayMakeFFmpegOpen(t *testing.T) {
+	// The input is attacker-supplied. ffmpeg can be told by a file's CONTENT to open
+	// other files or URLs (HLS and concat playlists); recent versions refuse by
+	// default, but that is version luck. Pin it: local files and pipes only, and
+	// only the demuxers real audio recordings use.
+	bin, argvFile := argvStub(t)
+
+	_, err := (&audio.FFprobe{Bin: bin}).Probe(context.Background(), "/spool/upload-1")
+
+	require.NoError(t, err)
+	args := argvOf(t, argvFile)
+	pw := indexOf(args, "-protocol_whitelist")
+	require.GreaterOrEqual(t, pw, 0, "argv: %v", args)
+	assert.Equal(t, "file,pipe", args[pw+1])
+	fw := indexOf(args, "-format_whitelist")
+	require.GreaterOrEqual(t, fw, 0, "argv: %v", args)
+	assert.Equal(t, audio.AllowedDemuxers, args[fw+1])
+	assert.Equal(t, "/spool/upload-1", args[len(args)-1], "the path stays the last argument")
+}
+
+func TestAllowedDemuxers_ExcludeThePlaylistFormats(t *testing.T) {
+	for _, bad := range []string{"concat", "hls", "applehttp", "dash", "rtsp", "sdp", "image2"} {
+		assert.NotContains(t, strings.Split(audio.AllowedDemuxers, ","), bad,
+			"%s can make ffmpeg open other files or URLs named inside the upload", bad)
+	}
+	for _, good := range []string{"wav", "mov", "mp4", "m4a", "mp3", "ogg", "matroska", "flac"} {
+		assert.Contains(t, strings.Split(audio.AllowedDemuxers, ","), good)
+	}
+}

internal/adapters/audio/hostile_live_test.go

@@ -0,0 +1,32 @@
+package audio_test
+
+import (
+	"context"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"git.d-ma.be/mathias/tapir/internal/adapters/audio"
+	"git.d-ma.be/mathias/tapir/internal/uploads"
+)
+
+// TestFFprobeLive_HostilePlaylistsAreRefusedAndRealAudioIsNot runs the REAL ffprobe
+// (opt-in: TAPIR_LIVE_FFPROBE) on crafted concat/HLS files and on a real m4a.
+func TestFFprobeLive_HostilePlaylistsAreRefusedAndRealAudioIsNot(t *testing.T) {
+	bin := os.Getenv("TAPIR_LIVE_FFPROBE")
+	if bin == "" {
+		t.Skip("set TAPIR_LIVE_FFPROBE (and TAPIR_LIVE_HOSTILE_DIR, TAPIR_LIVE_M4A) to run against the real ffprobe")
+	}
+	p := &audio.FFprobe{Bin: bin}
+	for _, name := range []string{"up-concat", "up-hls"} {
+		_, err := p.Probe(context.Background(), os.Getenv("TAPIR_LIVE_HOSTILE_DIR")+"/"+name)
+		assert.ErrorIs(t, err, uploads.ErrUnreadable, name)
+	}
+	got, err := p.Probe(context.Background(), os.Getenv("TAPIR_LIVE_M4A"))
+	require.NoError(t, err)
+	assert.True(t, got.HasAudio)
+	assert.False(t, got.HasVideo)
+	assert.InDelta(t, 82.5, got.Duration.Seconds(), 1)
+}