player: refine rar:// playlist-safety handling

It was possible to make the player play local files by putting rar://
links into remote playlists, and some other potentially unsafe things.

Redo the handling of it. Now the rar-redirector (the thing in
demux_playlist.c) sets disable_safety, which makes the player open any
playlist entries returned. This is fine, because it redirects to the
same file anyway (just with different selection/interpretation of the
contents). On the other hand, rar:// itself is now considered fully
unsafe, which means that it is ignored if found in normal playlists.

(cherry picked from commit a4b6bf8c41b54554286117b97e78412a32b5147f)

6 files changed, 11 insertions, 9 deletions

diff --git a/common/playlist.h b/common/playlist.h
index e0ac816774..119e591db8 100644
--- a/common/playlist.h
+++ b/common/playlist.h
@@ -62,6 +62,8 @@ struct playlist {
     // current_was_replaced is set to true.
     struct playlist_entry *current;
     bool current_was_replaced;
+
+    bool disable_safety;
 };
 
 void playlist_entry_add_param(struct playlist_entry *e, bstr name, bstr value);
diff --git a/demux/demux_playlist.c b/demux/demux_playlist.c
index 50c46ae41a..9602eaf622 100644
--- a/demux/demux_playlist.c
+++ b/demux/demux_playlist.c
@@ -201,6 +201,7 @@ static int parse_rar(struct pl_parser *p)
     if (RarParse(p->s, &count, &files))
         return -1;
 
+    p->pl->disable_safety = true; // make it load rar://
     char *prefix = mp_url_escape(p, p->real_stream->url, "~|");
     for (int n = 0; n < count; n++) {
         // stream_rar.c does the real work
diff --git a/player/loadfile.c b/player/loadfile.c
index 9adf1fec87..76a28c270f 100644
--- a/player/loadfile.c
+++ b/player/loadfile.c
@@ -1118,10 +1118,13 @@ goto_reopen_demuxer: ;
     load_timeline(mpctx);
 
     if (mpctx->demuxer->playlist) {
-        int entry_stream_flags =
-            (mpctx->demuxer->stream->safe_origin ? 0 : STREAM_SAFE_ONLY) |
-            (mpctx->demuxer->stream->is_network ? STREAM_NETWORK_ONLY : 0);
         struct playlist *pl = mpctx->demuxer->playlist;
+        int entry_stream_flags = 0;
+        if (!pl->disable_safety) {
+            entry_stream_flags = STREAM_SAFE_ONLY;
+            if (mpctx->demuxer->stream->is_network)
+                entry_stream_flags |= STREAM_NETWORK_ONLY;
+        }
         for (struct playlist_entry *e = pl->first; e; e = e->next)
             e->stream_flags |= entry_stream_flags;
         transfer_playlist(mpctx, pl);
diff --git a/stream/stream.c b/stream/stream.c
index c16221add6..91f430f1e6 100644
--- a/stream/stream.c
+++ b/stream/stream.c
@@ -735,7 +735,6 @@ static stream_t *open_cache(stream_t *orig, const char *name)
     cache->mime_type = talloc_strdup(cache, orig->mime_type);
     cache->demuxer = talloc_strdup(cache, orig->demuxer);
     cache->lavf_type = talloc_strdup(cache, orig->lavf_type);
-    cache->safe_origin = orig->safe_origin;
     cache->streaming = orig->streaming,
     cache->is_network = orig->is_network;
     cache->opts = orig->opts;
diff --git a/stream/stream.h b/stream/stream.h
index 9908951bad..b2b92cd6eb 100644
--- a/stream/stream.h
+++ b/stream/stream.h
@@ -194,7 +194,6 @@ typedef struct stream {
     bool streaming : 1; // known to be a network stream if true
     bool seekable : 1; // presence of general byte seeking support
     bool fast_skip : 1; // consider stream fast enough to fw-seek by skipping
-    bool safe_origin : 1; // used for playlists that can be opened safely
     bool is_network : 1; // original stream_info_t.is_network flag
     bool allow_caching : 1; // stream cache makes sense
     struct mp_log *log;
diff --git a/stream/stream_rar.c b/stream/stream_rar.c
index 1051e05ab4..510babf949 100644
--- a/stream/stream_rar.c
+++ b/stream/stream_rar.c
@@ -98,8 +98,8 @@ static int rar_entry_open(stream_t *stream)
     *name++ = '\0';
     mp_url_unescape_inplace(base);
 
-    struct stream *rar = stream_create(base, STREAM_READ, stream->cancel,
-                                       stream->global);
+    struct stream *rar = stream_create(base, STREAM_READ | STREAM_SAFE_ONLY,
+                                       stream->cancel, stream->global);
     if (!rar)
         return STREAM_ERROR;
 
@@ -146,6 +146,4 @@ const stream_info_t stream_info_rar = {
     .name = "rar",
     .open = rar_entry_open,
     .protocols = (const char*const[]){ "rar", NULL },
-    .is_safe = true,
-    .is_network = true, // safe over network
 };