T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/setup_resources.py:55- Finding
Unverified Third-Party FFmpeg Executable Is Downloaded and Executed During Bootstrap
- Content
View full analysis
bool: """Run the executable with the supplied arguments and report success.""" for flag in flags: try: result = subprocess.run( [str(exe_path), flag], capture_output=True, timeout=15, ) if result.returncode == 0: return True except Exception: continue return False ``` ```python def _download_with_progress(url: str, dest: Path, timeout: int = DOWNLOAD_TIMEOUT) -> None: """Download URL to dest.""" log.info(f" Downloading: {url}") log.warn(f" Destination: {dest} (timeout {timeout}s)") old_timeout = socket.getdefaulttimeout() socket.setdefaulttimeout(timeout) try: urllib.request.urlretrieve(url, str(dest)) finally: socket.setdefaulttimeout(old_timeout) ``` ```python for url in FFMPEG_ZIP_URLS: try: _download_with_progress(url, zip_path) if zip_path.stat().st_size == 0: continue with zipfile.ZipFile(zip_path, "r") as zf: if _find_in_zip(zf, "ffmpeg.exe") and _find_in_zip(zf, "ffprobe.exe"): downloaded_ok = True break except Exception as e: log.warn(f"[ffmpeg] Current source failed: {e}") continue ``` ```python with zf.open(ffmpeg_zip_path) as src, open(ffmpeg_dest, "wb") as dst: shutil.copyfileobj(src, dst) with zf.open(ffprobe_zip_path) as src, open(ffprobe_dest, "wb") as dst: shutil ...[truncated 3421 chars]- Remediation
View remediation