stream, demux: redo origin policy thing

mpv has a very weak and very annoying policy that determines whether a
playlist should be used or not. For example, if you play a remote
playlist, you usually don't want it to be able to read local filesystem
entries. (Although for a media player the impact is small I guess.)

It's weak and annoying as in that it does not prevent certain cases
which could be interpreted as bad in some cases, such as allowing
playlists on the local filesystem to reference remote URLs. It probably
barely makes sense, but we just want to exclude some other "definitely
not a good idea" things, all while playlists generally just work, so
whatever.

The policy is:
- from the command line anything is played
- local playlists can reference anything except "unsafe" streams
  ("unsafe" means special stream inputs like libavfilter graphs)
- remote playlists can reference only remote URLs
- things like "memory://" and archives are "transparent" to this

This commit does... something. It replaces the weird stream flags with a
slightly clearer "origin" value, which is now consequently passed down
and used everywhere. It fixes some deviations from the described policy.

I wanted to force archives to reference only content within them, but
this would probably have been more complicated (or required different
abstractions), and I'm too lazy to figure it out, so archives are now
"transparent" (playlists within archives behave the same outside).

There may be a lot of bugs in this.

This is unfortunately a very noisy commit because:
- every stream open call now needs to pass the origin
- so does every demuxer open call (=> params param. gets mandatory)
- most stream were changed to provide the "origin" value
- the origin value needed to be passed along in a lot of places
- I was too lazy to split the commit

Fixes: #7274

12 files changed, 30 insertions, 10 deletions

diff --git a/demux/demux.c b/demux/demux.c
index 813cb1aa23..21ad3383c1 100644
--- a/demux/demux.c
+++ b/demux/demux.c
@@ -2894,6 +2894,7 @@ static void demux_copy(struct demuxer *dst, struct demuxer *src)
     dst->duration = src->duration;
     dst->is_network = src->is_network;
     dst->is_streaming = src->is_streaming;
+    dst->stream_origin = src->stream_origin;
     dst->priv = src->priv;
     dst->metadata = mp_tags_dup(dst, src->metadata);
 }
@@ -3145,6 +3146,7 @@ struct parent_stream_info {
     bool seekable;
     bool is_network;
     bool is_streaming;
+    int stream_origin;
     struct mp_cancel *cancel;
     char *filename;
 };
@@ -3176,6 +3178,7 @@ static struct demuxer *open_given_type(struct mpv_global *global,
         .filename = talloc_strdup(demuxer, sinfo->filename),
         .is_network = sinfo->is_network,
         .is_streaming = sinfo->is_streaming,
+        .stream_origin = sinfo->stream_origin,
         .access_references = opts->access_references,
         .events = DEMUX_EVENT_ALL,
         .duration = -1,
@@ -3309,6 +3312,7 @@ static struct demuxer *demux_open(struct stream *stream,
         .seekable = stream->seekable,
         .is_network = stream->is_network,
         .is_streaming = stream->streaming,
+        .stream_origin = stream->stream_origin,
         .cancel = cancel,
         .filename = talloc_strdup(NULL, stream->url),
     };
@@ -3364,9 +3368,8 @@ struct demuxer *demux_open_url(const char *url,
                                struct mp_cancel *cancel,
                                struct mpv_global *global)
 {
-    struct demuxer_params dummy = {0};
     if (!params)
-        params = &dummy;
+        return NULL;
     struct mp_cancel *priv_cancel = mp_cancel_new(NULL);
     if (cancel)
         mp_cancel_set_parent(priv_cancel, cancel);
diff --git a/demux/demux.h b/demux/demux.h
index 235744c6f7..4c15e074c2 100644
--- a/demux/demux.h
+++ b/demux/demux.h
@@ -197,6 +197,7 @@ typedef struct demuxer {
     bool fully_read;
     bool is_network; // opened directly from a network stream
     bool is_streaming; // implies a "slow" input, such as network or FUSE
+    int stream_origin; // any STREAM_ORIGIN_* (set from source stream)
     bool access_references; // allow opening other files/URLs
 
     // Bitmask of DEMUX_EVENT_*
diff --git a/demux/demux_cue.c b/demux/demux_cue.c
index 35874972b9..edd1a97d1b 100644
--- a/demux/demux_cue.c
+++ b/demux/demux_cue.c
@@ -78,7 +78,11 @@ static bool try_open(struct timeline *tl, char *filename)
         || bstrcasecmp(bstr0(tl->demuxer->filename), bfilename) == 0)
         return false;
 
-    struct demuxer *d = demux_open_url(filename, NULL, tl->cancel, tl->global);
+    struct demuxer_params p = {
+        .stream_flags = tl->stream_origin,
+    };
+
+    struct demuxer *d = demux_open_url(filename, &p, tl->cancel, tl->global);
     // Since .bin files are raw PCM data with no headers, we have to explicitly
     // open them. Also, try to avoid to open files that are most likely not .bin
     // files, as that would only play noise. Checking the file extension is
@@ -87,7 +91,7 @@ static bool try_open(struct timeline *tl, char *filename)
     //       CD sector size (2352 bytes)
     if (!d && bstr_case_endswith(bfilename, bstr0(".bin"))) {
         MP_WARN(tl, "CUE: Opening as BIN file!\n");
-        struct demuxer_params p = {.force_format = "rawaudio"};
+        p.force_format = "rawaudio";
         d = demux_open_url(filename, &p, tl->cancel, tl->global);
     }
     if (d) {
diff --git a/demux/demux_disc.c b/demux/demux_disc.c
index 919360d074..3dfff45403 100644
--- a/demux/demux_disc.c
+++ b/demux/demux_disc.c
@@ -296,6 +296,7 @@ static int d_open(demuxer_t *demuxer, enum demux_check check)
     struct demuxer_params params = {
         .force_format = "+lavf",
         .external_stream = demuxer->stream,
+        .stream_flags = demuxer->stream_origin,
     };
 
     struct stream *cur = demuxer->stream;
diff --git a/demux/demux_edl.c b/demux/demux_edl.c
index 1ac912888f..b1f268ad8b 100644
--- a/demux/demux_edl.c
+++ b/demux/demux_edl.c
@@ -203,6 +203,7 @@ static struct demuxer *open_source(struct timeline *root,
     }
     struct demuxer_params params = {
         .init_fragment = tl->init_fragment,
+        .stream_flags = root->stream_origin,
     };
     struct demuxer *d = demux_open_url(filename, &params, root->cancel,
                                        root->global);
@@ -268,7 +269,8 @@ static struct timeline_par *build_timeline(struct timeline *root,
 
     if (parts->init_fragment_url && parts->init_fragment_url[0]) {
         MP_VERBOSE(root, "Opening init fragment...\n");
-        stream_t *s = stream_create(parts->init_fragment_url, STREAM_READ,
+        stream_t *s = stream_create(parts->init_fragment_url,
+                                    STREAM_READ | root->stream_origin,
                                     root->cancel, root->global);
         if (s) {
             root->is_network |= s->is_network;
@@ -282,6 +284,7 @@ static struct timeline_par *build_timeline(struct timeline *root,
         }
         struct demuxer_params params = {
             .init_fragment = tl->init_fragment,
+            .stream_flags = root->stream_origin,
         };
         tl->track_layout = demux_open_url("memory://", &params, root->cancel,
                                           root->global);
diff --git a/demux/demux_libarchive.c b/demux/demux_libarchive.c
index 80bd3e240e..f2e669aa72 100644
--- a/demux/demux_libarchive.c
+++ b/demux/demux_libarchive.c
@@ -64,9 +64,6 @@ static int open_file(struct demuxer *demuxer, enum demux_check check)
     struct playlist *pl = talloc_zero(demuxer, struct playlist);
     demuxer->playlist = pl;
 
-    // make it load archive://
-    pl->disable_safety = true;
-
     char *prefix = mp_url_escape(mpa, demuxer->stream->url, "~|");
 
     char **files = NULL;
@@ -85,6 +82,9 @@ static int open_file(struct demuxer *demuxer, enum demux_check check)
     for (int n = 0; n < num_files; n++)
         playlist_add_file(pl, files[n]);
 
+    for (struct playlist_entry *e = pl->first; e; e = e->next)
+        e->stream_flags = demuxer->stream_origin;
+
     demuxer->filetype = "archive";
     demuxer->fully_read = true;
 
diff --git a/demux/demux_mf.c b/demux/demux_mf.c
index 6698ef8c62..2f46d356f3 100644
--- a/demux/demux_mf.c
+++ b/demux/demux_mf.c
@@ -188,8 +188,10 @@ static bool demux_mf_read_packet(struct demuxer *demuxer,
     struct stream *stream = entry_stream;
     if (!stream) {
         char *filename = mf->names[mf->curr_frame];
-        if (filename)
-            stream = stream_open(filename, demuxer->global);
+        if (filename) {
+            stream = stream_create(filename, demuxer->stream_origin | STREAM_READ,
+                                   demuxer->cancel, demuxer->global);
+        }
     }
 
     if (stream) {
diff --git a/demux/demux_mkv_timeline.c b/demux/demux_mkv_timeline.c
index 5bbadc0781..22d859c75c 100644
--- a/demux/demux_mkv_timeline.c
+++ b/demux/demux_mkv_timeline.c
@@ -172,6 +172,7 @@ static bool check_file_seg(struct tl_ctx *ctx, char *filename, int segment)
         .matroska_wanted_segment = segment,
         .matroska_was_valid = &was_valid,
         .disable_timeline = true,
+        .stream_flags = ctx->tl->stream_origin,
     };
     struct mp_cancel *cancel = ctx->tl->cancel;
     if (mp_cancel_test(cancel))
diff --git a/demux/demux_playlist.c b/demux/demux_playlist.c
index 00db544b30..b40beda980 100644
--- a/demux/demux_playlist.c
+++ b/demux/demux_playlist.c
@@ -462,6 +462,8 @@ static int open_file(struct demuxer *demuxer, enum demux_check check)
     bool ok = fmt->parse(p) >= 0 && !p->error;
     if (p->add_base)
         playlist_add_base_path(p->pl, mp_dirname(demuxer->filename));
+    for (struct playlist_entry *e = p->pl->first; e; e = e->next)
+        e->stream_flags = demuxer->stream_origin;
     demuxer->playlist = talloc_steal(demuxer, p->pl);
     demuxer->filetype = p->format ? p->format : fmt->name;
     demuxer->fully_read = true;
diff --git a/demux/demux_timeline.c b/demux/demux_timeline.c
index f8f096c464..ecce06bcb2 100644
--- a/demux/demux_timeline.c
+++ b/demux/demux_timeline.c
@@ -212,6 +212,7 @@ static void reopen_lazy_segments(struct demuxer *demuxer,
     struct demuxer_params params = {
         .init_fragment = src->tl->init_fragment,
         .skip_lavf_probing = true,
+        .stream_flags = demuxer->stream_origin,
     };
     src->current->d = demux_open_url(src->current->url, &params,
                                      demuxer->cancel, demuxer->global);
diff --git a/demux/timeline.c b/demux/timeline.c
index 967c20da01..0e5ff75192 100644
--- a/demux/timeline.c
+++ b/demux/timeline.c
@@ -17,6 +17,7 @@ struct timeline *timeline_load(struct mpv_global *global, struct mp_log *log,
         .cancel = demuxer->cancel,
         .demuxer = demuxer,
         .format = "unknown",
+        .stream_origin = demuxer->stream_origin,
     };
 
     demuxer->desc->load_timeline(tl);
diff --git a/demux/timeline.h b/demux/timeline.h
index e64b2f96c9..c8151a0606 100644
--- a/demux/timeline.h
+++ b/demux/timeline.h
@@ -36,6 +36,7 @@ struct timeline {
     struct mp_cancel *cancel;
 
     bool is_network, is_streaming;
+    int stream_origin;
     const char *format;
 
     // main source, and all other sources (this usually only has special meaning