[MPlayer-users] playlist suggestion

[Reimar Döffinger]

Hello,
On Mon, Apr 30, 2007 at 08:22:57PM -0500, Joey Parrish wrote:
> On 4/30/07, RC <rcooley at spamcop.net> wrote:
> > On Mon, 30 Apr 2007 22:26:45 +0100
> > "Robert Parker" <theparkers.mailbox at gmail.com> wrote:
> >
> > > Why doesnt mplayer just recognise known file extensions as play list
> > > files ?
> >
> > Security.
> >
> > For something like a browser plug-in, where you have untrusted content,
> > I would suggest parsing the playlist with your own program, and giving
> > only the final result to MPlayer.
> 
> Are the MPlayer playlist parsers inherently insecure?  Is there a good
> reason not to fix them?

Note that there also is an inherent insecurity: A play list can cause
_any_ file or device or your PC an also at any place on the internet being
read by MPlayer.
There is no way to fix this inherent problem in MPlayer, whereas
browsers already now have all the code check which site may access which
other, not to mention already having the XML/tag soup parsers needed for
quite a few playlist formats.

Greetings,
Reimar Döffinger