T09 · Insecure Skill Coding Practices
- Location
scripts/combine_videos.py:41- Finding
FFconcat Directive Injection Through Unescaped Video Filenames
- Content
View full analysis
Vulnerability Details
File Location:
scripts/combine_videos.py, lines 41–49
Vulnerability Type: Unsafe ffconcat manifest generation
Risk Level: MediumVulnerable Code
python # Generate concat list file list_file = output_path.parent / 'concat-list.txt' with open(list_file, 'w', encoding='utf-8') as f: for vf in video_files: f.write(f"file '{Path(vf).as_posix()}'\n") cmd = [ 'ffmpeg', '-y', '-f', 'concat', '-safe', '0',Technical Analysis
The script obtains video paths from directory entries matching
geo-video-*.mp4and writes those paths directly into an ffconcat manifest. It does not reject or escape apostrophes, backslashes, carriage returns, newlines, or other characters significant to ffconcat syntax.Although ffmpeg is invoked through an argument array rather than a shell, that protection does not prevent injection into the separately parsed concat manifest. A crafted filename can terminate or alter a
filedirective and introduce additional manifest content. The use of-safe 0weakens ffmpeg's path validation and permits absolute paths and protocol-style resources that would otherwise be rejected by safe mode.Exploitation requires the attacker to create or control the name of a matching file in the selected input directory.
Attack Path
- An attacker obtains the ability to place or rename files in the directory supplied through
--input-dir. - The attacker creates a filename beginning with
geo-video-, ending with.mp4, and containing quote or line-break characters that alter ffconcat syntax. - The glob operation accepts the crafted filename because it matches
geo-video-*.mp4. - The script writes the filename verbatim into
concat-list.txt. - ffmpeg parses the attacker-influenced manifest with
-safe 0. - Subject to the protocols and features enabled in the installed ffmpeg build, ffmpeg may open an unintended local path or ...[truncated 879 chars]
- An attacker obtains the ability to place or rename files in the directory supplied through
- Remediation
View remediation
Remediation Suggestions
- Reject filenames containing control characters, carriage returns, line feeds, apostrophes, backslashes, or other ffconcat-significant characters.
- Resolve every candidate with
Path.resolve()and verify that it remains beneath the resolved input directory. - Avoid
-safe 0; use-safe 1and safe relative filenames wherever possible. - Create a private temporary directory and populate it with fixed, application-generated filenames such as
video-0001.mp4. Copy or safely link validated inputs into that directory, then generate the manifest exclusively from those fixed names. - Restrict permitted ffmpeg protocols with an explicit protocol whitelist when supported, excluding network protocols unless the workflow requires them.
- Create manifest and temporary files with restrictive permissions and unpredictable names, then remove them after processing.
- Check subprocess return codes for ffprobe and all ffmpeg operations, and reject malformed or unexpected media before concatenation.
- Add regression tests using filenames containing quotes, newlines, backslashes, absolute-path syntax, and URL-like text to confirm they are rejected or safely handled.