fix(media-server): check every remote URL against a private-address policy by 07rjain · Pull Request #3000 · CapSoftware/Cap

07rjain · 2026-10-23T16:22:33Z

Split out of #2580 (media-server URL policy and DASH handling).

Problem. The media server fetched whatever URL a request named. Redirects, HLS/DASH playlist entries and webhook URLs could point at loopback, private networks or cloud metadata (169.254.169.254), and ffmpeg followed playlist entries on its own.

What changes

url-policy.ts: only http/https. Hosts that resolve to loopback, private, link-local, CGNAT or IPv6 ULA addresses are rejected unless trusted. Trusted means S3_INTERNAL_ENDPOINT, S3_PUBLIC_ENDPOINT, CAP_AWS_ENDPOINT, MEDIA_SERVER_WEBHOOK_URL, WEB_URL, or MEDIA_SERVER_ALLOWED_HOSTS, which becomes a strict allow-list when set. MEDIA_SERVER_ALLOW_PRIVATE_URLS=true is for local dev and tests.
fetchAllowed checks every redirect hop. It's used for inputs, thumbnails, probes (inside the probe limit and timeout), recording verification (which decodes from a checked local file), audio, audio-level webhooks, job webhooks and the opt-in parallel ranged downloads.
HLS and DASH manifests are downloaded and rewritten to local files before ffmpeg runs with -protocol_whitelist file,pipe.
- In DASH, MPD@Location is dropped and no longer changes the media base.
- Sibling <BaseURL>s are alternatives, so each resolves against its parent. An alternative that is missing or blocked is dropped instead of failing the job.
- Directory BaseURLs are never downloaded.
Blocked URLs return 400 URL_NOT_ALLOWED from the audio and video routes.
A failed remote audio download releases its operation right away.
The webhook secret is compared in constant time.
Compose files give the media server S3_INTERNAL_ENDPOINT/S3_PUBLIC_ENDPOINT/MEDIA_SERVER_WEBHOOK_URL so bundled MinIO stays trusted. packages/local-docker sets MEDIA_SERVER_ALLOW_PRIVATE_URLS=true.
Docs: "Media Server URL Policy" section.

Upgrade note. Self-hosts whose storage is on a private network must set S3_INTERNAL_ENDPOINT on the media server or list the host in MEDIA_SERVER_ALLOWED_HOSTS. Otherwise processing fails with URL_NOT_ALLOWED. The bundled compose files already do this.

Tests. url-policy.test.ts, redirect-follow.test.ts (probe, audio, thumbnail, verification and parallel download don't follow a redirect to a private address), and DASH tests for Location in another directory, sibling primary/backup BaseURLs and a missing alternative. Route tests now serve fixtures over HTTP because file: is rejected.

Confidence Score: 0/5

Do not merge until connections use checked addresses, callbacks stop forwarding secrets across redirects, and the HLS and DASH compatibility breaks are fixed.

Findings

DNS changes bypass the check ▶
Redirects receive the callback secret ▶
Encrypted HLS audio fails ▶
DASH fallback rejects valid templates ▶
Valid XML references stay remote ▶
HLS downloads duplicate whole files ▶
Redirect tests miss the redirect ▶

Fix with agent prompt

### Issue 1
apps/media-server/src/lib/url-policy.ts:285-286
`fetchAllowed` checks DNS, then gives the original hostname to `fetcher`, which resolves it again. A hostname in an attacker-controlled playlist can return a public address for the check and a private address for the connection. This leaves the private-address fix bypassable.

Bind each connection to an address that passed the check, including in `resolveAllowedUrl`.

**How this was verified:** Playlist resources reach `fetchAllowed`, but the addresses checked by `assertUrlAllowed` are never passed to the network connection.

### Issue 2
apps/media-server/src/lib/audio-levels.ts:78-85
The audio-level callback previously refused redirects. It now follows them through `fetchAllowed`, which sends the same `x-media-server-secret` and JSON body to every target. With the default policy, a redirect to another public host passes, exposing the callback secret and recording details to that host.

Keep redirect refusal for this callback, and make `fetchAllowed` respect `redirect: "error"`.

**How this was verified:** The callback includes the secret header, and the redirect loop reuses those headers and the body without checking whether the origin changed.

### Issue 3
apps/media-server/src/lib/media-audio.ts:123-124
`getAudioExtractArgs` now allows only `file,pipe`. AES-128 HLS still needs FFmpeg's `crypto` protocol after the key and segments have been downloaded locally, so encrypted HLS audio extraction now fails. Include `crypto` here, as `getAudioProbeArgs` and the video download command already do.

### Issue 4
apps/media-server/src/lib/media-video.ts:458-459
The generic DASH fallback now rejects every URL containing `$`, but the HLS converter does not cover all valid template shapes. For example, it does not read a `SegmentTemplate` inherited from `Period`. That manifest falls back here and throws on `$Number$`.

Previously the generic MPD kept the template for FFmpeg to expand. Expand these templates into checked local resources before rejecting the fallback.

### Issue 5
apps/media-server/src/lib/media-video.ts:471-472
`rewriteDashAttributes` only matches double-quoted attributes with no spaces around `=`. Valid XML such as `<SegmentURL media='seg-1.m4s'/>` is left unchanged, so its resource is never downloaded.

This worked before because FFmpeg could fetch the remote resource. With directory `BaseURL` elements removed and network protocols disabled, FFmpeg now looks for a nonexistent local file or rejects the remote URL. Parse these attributes with the same quote and whitespace support as `parseXmlAttributes`.

### Issue 6
apps/media-server/src/lib/media-video.ts:394-399
Each HLS resource occurrence now downloads the entire URL into a fresh file. A byte-range playlist can name one large media file hundreds of times, so this downloads and stores hundreds of full copies instead of the requested ranges. Cache downloads by resolved URL, or download the named ranges and rewrite their offsets.

### Issue 7
apps/media-server/src/__tests__/lib/redirect-follow.test.ts:51-56
These tests start with a private loopback URL while private URLs are disabled. The policy rejects the first URL, so the redirect response is never reached. All five tests would still pass if the corresponding download path followed unchecked redirects after allowing the initial URL.

Make the first hop allowed, redirect it to a different blocked destination, and assert that the first hop was requested.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

This PR adds a shared URL policy across media downloads, redirects, and callbacks.

Media-server requests now check each URL before connecting.
Streaming playlists now use checked local copies during processing.
Remote media is saved locally before audio, probe, and verification work.
Media-server secret checks no longer reveal partial matches.

_{Reviews (1) · Last reviewed commit: "fix(media-server): check every remote UR..." · Reviewed by Greptile}

…olicy and localize DASH/HLS inputs The media server fetched whatever URL a request named, and ffmpeg followed playlist entries and redirects on its own. Every remote read (inputs, HLS/DASH resources, thumbnails, probes, recording verification, audio, webhooks, parallel ranged downloads) now goes through fetchAllowed: only http(s), no loopback/private/link-local/metadata/CGNAT/ULA addresses unless the host is trusted or listed in MEDIA_SERVER_ALLOWED_HOSTS, and each redirect hop is checked again. HLS and DASH manifests are downloaded and rewritten to local files before ffmpeg runs with a file,pipe protocol whitelist. In DASH, MPD@Location no longer changes the media base and sibling BaseURLs resolve against their parent. The webhook secret is compared in constant time.

vercel · 2026-10-23T16:22:42Z

@07rjain is attempting to deploy a commit to the Cap Software Inc Team on Vercel.

A member of the Team first needs to authorize it.

greptile-apps · 2026-10-23T16:30:19Z

+		await assertUrlAllowed(current, policy, resolve);
+		const response = await fetcher(current, withManualRedirect(init));


DNS changes bypass the check

fetchAllowed checks DNS, then gives the original hostname to fetcher, which resolves it again. A hostname in an attacker-controlled playlist can return a public address for the check and a private address for the connection. This leaves the private-address fix bypassable.

Bind each connection to an address that passed the check, including in resolveAllowedUrl.

How this was verified: Playlist resources reach fetchAllowed, but the addresses checked by assertUrlAllowed are never passed to the network connection.

Prompt To Fix With AI

This is a comment left during a code review. Path: apps/media-server/src/lib/url-policy.ts Line: 285-286 Comment: **DNS changes bypass the check** `fetchAllowed` checks DNS, then gives the original hostname to `fetcher`, which resolves it again. A hostname in an attacker-controlled playlist can return a public address for the check and a private address for the connection. This leaves the private-address fix bypassable. Bind each connection to an address that passed the check, including in `resolveAllowedUrl`. **How this was verified:** Playlist resources reach `fetchAllowed`, but the addresses checked by `assertUrlAllowed` are never passed to the network connection. --- For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

greptile-apps · 2026-10-23T16:30:19Z

+				const response = await fetchAllowed(webhookUrl, {
 					method: "POST",
 					headers: {
 						"Content-Type": "application/json",
 						"x-media-server-secret": webhookSecret,
 					},
 					body: JSON.stringify({ kind: "audio-levels", ...body }),
-					redirect: "error",
 					signal,


Redirects receive the callback secret

The audio-level callback previously refused redirects. It now follows them through fetchAllowed, which sends the same x-media-server-secret and JSON body to every target. With the default policy, a redirect to another public host passes, exposing the callback secret and recording details to that host.

Keep redirect refusal for this callback, and make fetchAllowed respect redirect: "error".

How this was verified: The callback includes the secret header, and the redirect loop reuses those headers and the body without checking whether the origin changed.

Prompt To Fix With AI

This is a comment left during a code review. Path: apps/media-server/src/lib/audio-levels.ts Line: 78-85 Comment: **Redirects receive the callback secret** The audio-level callback previously refused redirects. It now follows them through `fetchAllowed`, which sends the same `x-media-server-secret` and JSON body to every target. With the default policy, a redirect to another public host passes, exposing the callback secret and recording details to that host. Keep redirect refusal for this callback, and make `fetchAllowed` respect `redirect: "error"`. **How this was verified:** The callback includes the secret header, and the redirect loop reuses those headers and the body without checking whether the origin changed. --- For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

greptile-apps · 2026-10-23T16:30:19Z

+		"-protocol_whitelist",
+		"file,pipe",


Encrypted HLS audio fails

getAudioExtractArgs now allows only file,pipe. AES-128 HLS still needs FFmpeg's crypto protocol after the key and segments have been downloaded locally, so encrypted HLS audio extraction now fails. Include crypto here, as getAudioProbeArgs and the video download command already do.

Prompt To Fix With AI

This is a comment left during a code review. Path: apps/media-server/src/lib/media-audio.ts Line: 123-124 Comment: **Encrypted HLS audio fails** `getAudioExtractArgs` now allows only `file,pipe`. AES-128 HLS still needs FFmpeg's `crypto` protocol after the key and segments have been downloaded locally, so encrypted HLS audio extraction now fails. Include `crypto` here, as `getAudioProbeArgs` and the video download command already do. --- For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

greptile-apps · 2026-10-23T16:30:19Z

+	if (resolved.includes("$")) {
+		throw new Error("DASH template URL cannot be fetched locally");


DASH fallback rejects valid templates

The generic DASH fallback now rejects every URL containing $, but the HLS converter does not cover all valid template shapes. For example, it does not read a SegmentTemplate inherited from Period. That manifest falls back here and throws on $Number$ .

Previously the generic MPD kept the template for FFmpeg to expand. Expand these templates into checked local resources before rejecting the fallback.

Prompt To Fix With AI

This is a comment left during a code review. Path: apps/media-server/src/lib/media-video.ts Line: 458-459 Comment: **DASH fallback rejects valid templates** The generic DASH fallback now rejects every URL containing `$`, but the HLS converter does not cover all valid template shapes. For example, it does not read a `SegmentTemplate` inherited from `Period`. That manifest falls back here and throws on `$Number$`. Previously the generic MPD kept the template for FFmpeg to expand. Expand these templates into checked local resources before rejecting the fallback. --- For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

greptile-apps · 2026-10-23T16:30:19Z

+	return attributes.replace(
+		/(initialization|media|sourceURL|xlink:href|href)="([^"]+)"/gi,


Valid XML references stay remote

rewriteDashAttributes only matches double-quoted attributes with no spaces around =. Valid XML such as <SegmentURL media='seg-1.m4s'/> is left unchanged, so its resource is never downloaded.

This worked before because FFmpeg could fetch the remote resource. With directory BaseURL elements removed and network protocols disabled, FFmpeg now looks for a nonexistent local file or rejects the remote URL. Parse these attributes with the same quote and whitespace support as parseXmlAttributes.

Prompt To Fix With AI

This is a comment left during a code review. Path: apps/media-server/src/lib/media-video.ts Line: 471-472 Comment: **Valid XML references stay remote** `rewriteDashAttributes` only matches double-quoted attributes with no spaces around `=`. Valid XML such as `<SegmentURL media='seg-1.m4s'/>` is left unchanged, so its resource is never downloaded. This worked before because FFmpeg could fetch the remote resource. With directory `BaseURL` elements removed and network protocols disabled, FFmpeg now looks for a nonexistent local file or rejects the remote URL. Parse these attributes with the same quote and whitespace support as `parseXmlAttributes`. --- For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

greptile-apps · 2026-10-23T16:30:19Z

+				return await downloadAllowedResource(
+					resolved,
+					dirPath,
+					abortSignal,
+					limit,
+				);


HLS downloads duplicate whole files

Each HLS resource occurrence now downloads the entire URL into a fresh file. A byte-range playlist can name one large media file hundreds of times, so this downloads and stores hundreds of full copies instead of the requested ranges. Cache downloads by resolved URL, or download the named ranges and rewrite their offsets.

Prompt To Fix With AI

This is a comment left during a code review. Path: apps/media-server/src/lib/media-video.ts Line: 394-399 Comment: **HLS downloads duplicate whole files** Each HLS resource occurrence now downloads the entire URL into a fresh file. A byte-range playlist can name one large media file hundreds of times, so this downloads and stores hundreds of full copies instead of the requested ranges. Cache downloads by resolved URL, or download the named ranges and rewrite their offsets. --- For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

greptile-apps · 2026-10-23T16:30:19Z

+	test("probe does not fetch the redirect target", async () => {
+		process.env.MEDIA_SERVER_ALLOW_PRIVATE_URLS = "false";
+		const target = privateRedirectServer();
+		try {
+			await expect(probeVideo(target.url)).rejects.toThrow("private address");
+			expect(target.secretHits()).toBe(0);


Redirect tests miss the redirect

These tests start with a private loopback URL while private URLs are disabled. The policy rejects the first URL, so the redirect response is never reached. All five tests would still pass if the corresponding download path followed unchecked redirects after allowing the initial URL.

Make the first hop allowed, redirect it to a different blocked destination, and assert that the first hop was requested.

Prompt To Fix With AI

This is a comment left during a code review. Path: apps/media-server/src/__tests__/lib/redirect-follow.test.ts Line: 51-56 Comment: **Redirect tests miss the redirect** These tests start with a private loopback URL while private URLs are disabled. The policy rejects the first URL, so the redirect response is never reached. All five tests would still pass if the corresponding download path followed unchecked redirects after allowing the initial URL. Make the first hop allowed, redirect it to a different blocked destination, and assert that the first hop was requested. --- For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

07rjain mentioned this pull request Oct 23, 2026

fix(self-host): harden the media server and shrink the embed #2580

Closed

6 tasks

greptile-apps Bot reviewed Oct 23, 2026

View reviewed changes

Navigation Menu

Repository navigation

fix(media-server): check every remote URL against a private-address policy - #3000

fix(media-server): check every remote URL against a private-address policy#3000
07rjain wants to merge 1 commit into
CapSoftware:mainfrom
07rjain:split/media-url-policy

07rjain commented Oct 23, 2026 •

edited by greptile-apps Bot

Loading

Uh oh!

vercel Bot commented Oct 23, 2026

Uh oh!

greptile-apps Bot Oct 23, 2026

Uh oh!

greptile-apps Bot Oct 23, 2026

Uh oh!

greptile-apps Bot Oct 23, 2026

Uh oh!

greptile-apps Bot Oct 23, 2026

Uh oh!

greptile-apps Bot Oct 23, 2026

Uh oh!

greptile-apps Bot Oct 23, 2026

Uh oh!

greptile-apps Bot Oct 23, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

		await assertUrlAllowed(current, policy, resolve);
		const response = await fetcher(current, withManualRedirect(init));

		if (resolved.includes("$")) {
		throw new Error("DASH template URL cannot be fetched locally");

		return attributes.replace(
		/(initialization\|media\|sourceURL\|xlink:href\|href)="([^"]+)"/gi,

Conversation

07rjain commented Oct 23, 2026 • edited by greptile-apps Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 0/5

Findings

Summary

Uh oh!

vercel Bot commented Oct 23, 2026

Uh oh!

greptile-apps Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

07rjain commented Oct 23, 2026 •

edited by greptile-apps Bot

Loading