RESOLVED FIXED301092
[GStreamer] Restrict allowed URI protocols for media playback 
https://bugs.webkit.org/show_bug.cgi?id=301092
Summary [GStreamer] Restrict allowed URI protocols for media playback
Philippe Normand
Reported 2025-10-20 06:22:59 PDT
Currently we allow any protocol for which there is a GStreamer source element. We should allow only http(s), file, blob, data, mediastream, mediasource protocols. If some WEBKIT_GST_ALLOWED_URI_PROTOCOLS env var is set, parse its comma-separated contents and allow-list them as well. IIUC this should be implemented in MediaPlayerPrivateGStreamer::load(const String& urlString).
Attachments
Add attachment proposed patch, testcase, etc.
Cristina Murillo
Comment 1 2025-10-29 03:39:02 PDT
Pull request: https://github.com/WebKit/WebKit/pull/53137
EWS
Comment 2 2025-10-30 02:58:22 PDT
Committed 302338@main (7e871b506eab): <https://commits.webkit.org/302338@main> Reviewed commits have been landed. Closing PR #53137 and removing active labels.
Radar WebKit Bug Importer
Comment 3 2025-10-30 02:59:13 PDT
<rdar://problem/163701675>
Note You need to log in before you can comment on or make changes to this bug.