Security: pin every build input, disable network protocols, harden CI

From a security review of the repository (findings and non-goals in the PR).

- P0, supply chain: the Dockerfile frontend, the emsdk image (by digest),
  every git source (by commit) and the opus tarball (by checksum) are
  pinned, so a moved tag or branch can't change a release.
- The core is built with --disable-network: untrusted arguments or playlists
  could make the worker open WebSockets to arbitrary hosts, and network
  protocols can't work in a browser anyway.
- CI: least-privilege token (contents: read), checkout without persisted
  credentials, actions pinned by SHA at their latest releases (plus a
  dependabot config to keep them current), superseded PR runs cancelled.
- mount() only accepts file systems the core actually has; names such as
  "__proto__" returned an Object's prototype and broke FS.mount.
- fetchFile(): drop the base64 branch, whose regex never matched a real data
  URL; fetch() handles data: URLs.

Author: lucasgelfond

.github/dependabot.yml

@@ -0,0 +1,7 @@
+version: 2
+updates:
+  # Keeps the SHA-pinned actions in .github/workflows up to date.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

.github/workflows/CI.yml

@@ -10,20 +10,29 @@ on:
     - cron: "0 6 * * *"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   build-core:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Source Code
-        uses: actions/checkout@v2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Update pkg-config database
         run: sudo ldconfig
       - name: Setup Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@f87e5991ea3c3d8be0e5e2e2d1b6c4ecb9ac1a5f # v4.4.1
       - name: Cache build
         id: cache-build
-        uses: actions/cache@v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: build-cache
           key: build-cache-v2-${{ hashFiles('Dockerfile', 'Makefile', 'build/*') }}
@@ -32,7 +41,7 @@ jobs:
       - name: Build ffmpeg-core
         run: make prd EXTRA_ARGS="--cache-from=type=local,src=build-cache --cache-to=type=local,dest=build-cache,mode=max"
       - name: Upload core
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ffmpeg-core
           path: packages/core/dist/*
@@ -44,15 +53,16 @@ jobs:
       matrix:
         node: [22, 24, 26]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           submodules: true
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: ffmpeg-core
           path: packages/core/dist
-      - uses: pnpm/action-setup@v6
-      - uses: actions/setup-node@v4
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node }}
           cache: pnpm
@@ -63,15 +73,16 @@ jobs:
     runs-on: ubuntu-latest
     needs: [build-core]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           submodules: true
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: ffmpeg-core
           path: packages/core/dist
-      - uses: pnpm/action-setup@v6
-      - uses: actions/setup-node@v4
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
           cache: pnpm
@@ -85,17 +96,19 @@ jobs:
     runs-on: ubuntu-latest
     needs: [build-core]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: ffmpeg-core
           path: packages/core/dist
-      - uses: pnpm/action-setup@v6
-      - uses: actions/setup-node@v4
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
           cache: pnpm
-      - uses: actions/cache@v4
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: .cache/fate-suite
           key: fate-suite-v1
@@ -106,7 +119,7 @@ jobs:
       - name: Benchmarks
         if: always()
         run: pnpm bench
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()
         with:
           name: heavy-results

Dockerfile

@@ -1,11 +1,13 @@
-# syntax=docker/dockerfile-upstream:master-labs
+# syntax=docker/dockerfile:1.10@sha256:865e5dd094beca432e8c0a1d5e1c465db5f998dca4e439981029b3b81fb39ed5
+
+# Every input is pinned (image digests, git commits, tarball checksums) so a
+# release can't change underneath us. The comments name the pinned versions.
 
 # Base emsdk image with environment variables.
-FROM emscripten/emsdk:6.0.10 AS emsdk-base
+FROM emscripten/emsdk:6.0.10@sha256:e077d54e2b8970575ebc4f185ac1de0b95c05f2b266134d4ba27449af7aebf65 AS emsdk-base
 ARG EXTRA_CFLAGS
 ARG EXTRA_LDFLAGS
 ENV INSTALL_DIR=/opt
-ENV FFMPEG_VERSION=n9.0.2
 # FFmpeg's command line tools need threads since 6.1, so everything is built with pthreads.
 ENV CFLAGS="-I$INSTALL_DIR/include -pthread $EXTRA_CFLAGS"
 ENV CXXFLAGS="$CFLAGS"
@@ -19,38 +21,44 @@ COPY build/meson-cross.ini /meson-cross.ini
 
 # Build x264
 FROM emsdk-base AS x264-builder
+# stable branch
 ADD https://code.videolan.org/videolan/x264.git#b35605ace3ddf7c1a5d67a2eb553f034aef41d55 /src
 COPY build/x264.sh /src/build.sh
 RUN bash -x /src/build.sh
 
 # Build x265
 FROM emsdk-base AS x265-builder
-ADD https://bitbucket.org/multicoreware/x265_git.git#4.2 /src
+# 4.2
+ADD https://bitbucket.org/multicoreware/x265_git.git#e444744c03978c1fb4e037168967020cf2648427 /src
 COPY build/x265.sh /src/build.sh
 RUN bash -x /src/build.sh
 
 # Build libvpx
 FROM emsdk-base AS libvpx-builder
-ADD https://github.com/webmproject/libvpx.git#v1.17.0 /src
+# v1.17.0
+ADD https://github.com/webmproject/libvpx.git#6df3ec34557879fff673706f4a1d9fbd0f3a6f0e /src
 COPY build/libvpx.sh /src/build.sh
 RUN bash -x /src/build.sh
 
 # Build lame (3.100, the latest release; there is no upstream git repository)
 FROM emsdk-base AS lame-builder
-ADD https://github.com/ffmpegwasm/lame.git#master /src
+# 3.100
+ADD https://github.com/ffmpegwasm/lame.git#2badea1974ae36cb8312afe99cff1e6b3b5decee /src
 COPY build/lame.sh /src/build.sh
 RUN bash -x /src/build.sh
 
 # Build ogg
 FROM emsdk-base AS ogg-builder
-ADD https://github.com/xiph/ogg.git#v1.3.6 /src
+# v1.3.6
+ADD https://github.com/xiph/ogg.git#be05b13e98b048f0b5a0f5fa8ce514d56db5f822 /src
 COPY build/ogg.sh /src/build.sh
 RUN bash -x /src/build.sh
 
 # Build theora
 FROM emsdk-base AS theora-builder
 COPY --from=ogg-builder $INSTALL_DIR $INSTALL_DIR
-ADD https://github.com/xiph/theora.git#v1.2.0 /src
+# v1.2.0
+ADD https://github.com/xiph/theora.git#8e4808736e9c181b971306cc3f05df9e61354004 /src
 COPY build/theora.sh /src/build.sh
 RUN bash -x /src/build.sh
 
@@ -66,39 +74,45 @@ RUN bash -x /src/build.sh
 # Build vorbis
 FROM emsdk-base AS vorbis-builder
 COPY --from=ogg-builder $INSTALL_DIR $INSTALL_DIR
-ADD https://github.com/xiph/vorbis.git#v1.3.7 /src
+# v1.3.7
+ADD https://github.com/xiph/vorbis.git#0657aee69dec8508a0011f47f3b69d7538e9d262 /src
 COPY build/vorbis.sh /src/build.sh
 RUN bash -x /src/build.sh
 
 # Build zlib
 FROM emsdk-base AS zlib-builder
-ADD https://github.com/madler/zlib.git#v1.3.2 /src
+# v1.3.2
+ADD https://github.com/madler/zlib.git#da607da739fa6047df13e66a2af6b8bec7c2a498 /src
 COPY build/zlib.sh /src/build.sh
 RUN bash -x /src/build.sh
 
 # Build libwebp
 FROM emsdk-base AS libwebp-builder
 COPY --from=zlib-builder $INSTALL_DIR $INSTALL_DIR
-ADD https://github.com/webmproject/libwebp.git#v1.6.0 /src
+# v1.6.0
+ADD https://github.com/webmproject/libwebp.git#4fa21912338357f89e4fd51cf2368325b59e9bd9 /src
 COPY build/libwebp.sh /src/build.sh
 RUN bash -x /src/build.sh
 
 # Build freetype2
 FROM emsdk-base AS freetype2-builder
-ADD https://github.com/freetype/freetype.git#VER-2-14-3 /src
+# VER-2-14-3
+ADD https://github.com/freetype/freetype.git#0a0221a1347e2f1e07c395263540026e9a0aa7c7 /src
 COPY build/freetype2.sh /src/build.sh
 RUN bash -x /src/build.sh
 
 # Build fribidi
 FROM emsdk-base AS fribidi-builder
-ADD https://github.com/fribidi/fribidi.git#v1.0.17 /src
+# v1.0.17
+ADD https://github.com/fribidi/fribidi.git#b93119f5fdc7ea47672cc304c1455ffa6dfe7536 /src
 COPY build/fribidi.sh /src/build.sh
 RUN bash -x /src/build.sh
 
 # Build harfbuzz (with FreeType, for FFmpeg's drawtext)
 FROM emsdk-base AS harfbuzz-builder
 COPY --from=freetype2-builder $INSTALL_DIR $INSTALL_DIR
-ADD https://github.com/harfbuzz/harfbuzz.git#14.5.0 /src
+# 14.5.0
+ADD https://github.com/harfbuzz/harfbuzz.git#863d3f7787c6df18d20e4535c5906bf3eb803bd5 /src
 COPY build/harfbuzz.sh /src/build.sh
 RUN bash -x /src/build.sh
 
@@ -107,19 +121,22 @@ FROM emsdk-base AS libass-builder
 COPY --from=freetype2-builder $INSTALL_DIR $INSTALL_DIR
 COPY --from=fribidi-builder $INSTALL_DIR $INSTALL_DIR
 COPY --from=harfbuzz-builder $INSTALL_DIR $INSTALL_DIR
-ADD https://github.com/libass/libass.git#0.17.5 /src
+# 0.17.5
+ADD https://github.com/libass/libass.git#4a05d8127f525943ebf45fdc6497c9e665947f0d /src
 COPY build/libass.sh /src/build.sh
 RUN bash -x /src/build.sh
 
 # Build zimg
 FROM emsdk-base AS zimg-builder
-ADD https://github.com/sekrit-twc/zimg.git#release-3.0.6 /src
+# release-3.0.6
+ADD https://github.com/sekrit-twc/zimg.git#f819b14e8f39d1282400b0d9543e8ef73c1b2bbd /src
 COPY build/zimg.sh /src/build.sh
 RUN bash -x /src/build.sh
 
 # Base ffmpeg image with dependencies and source code populated.
 FROM emsdk-base AS ffmpeg-base
-ADD https://github.com/FFmpeg/FFmpeg.git#$FFMPEG_VERSION /src
+# n9.0.2
+ADD https://github.com/FFmpeg/FFmpeg.git#946fcce07b6dcd0331c8cc609192aeff5e1924f8 /src
 COPY --from=x264-builder $INSTALL_DIR $INSTALL_DIR
 COPY --from=x265-builder $INSTALL_DIR $INSTALL_DIR
 COPY --from=libvpx-builder $INSTALL_DIR $INSTALL_DIR

build/ffmpeg.sh

@@ -14,6 +14,7 @@ CONF_FLAGS=(
   --disable-runtime-cpudetect   # disable cpu detection
   --disable-autodetect          # disable env auto detect
   --pkg-config-flags=--static   # static libraries also need their private dependencies
+  --disable-network             # no sockets in a browser; untrusted args could otherwise open WebSockets
 
   # assign toolchains and extra flags
   --nm=emnm

packages/ffmpeg/src/worker.ts

@@ -151,9 +151,9 @@ const deleteDir = ({ path }: FFMessageDeleteDirData): OK => {
 };
 
 const mount = ({ fsType, options, mountPoint }: FFMessageMountData): OK => {
-  const str = fsType as keyof typeof ffmpeg.FS.filesystems;
-  const fs = ffmpeg.FS.filesystems[str];
-  if (!fs) return false;
+  // Only the file systems the core links; names like "__proto__" are not.
+  if (!Object.hasOwn(ffmpeg.FS.filesystems, fsType)) return false;
+  const fs = ffmpeg.FS.filesystems[fsType as keyof typeof ffmpeg.FS.filesystems];
   ffmpeg.FS.mount(fs, options, mountPoint);
   return true;
 };

packages/util/src/index.ts

@@ -52,15 +52,8 @@ export const fetchFile = async (
   let data: ArrayBuffer | number[];
 
   if (typeof file === "string") {
-    /* From base64 format */
-    if (/data:_data\/([a-zA-Z]*);base64,([^"]*)/.test(file)) {
-      data = atob(file.split(",")[1])
-        .split("")
-        .map((c) => c.charCodeAt(0));
-      /* From remote server/URL */
-    } else {
-      data = await (await fetch(file)).arrayBuffer();
-    }
+    /* From a URL, including data: URLs */
+    data = await (await fetch(file)).arrayBuffer();
   } else if (file instanceof URL) {
     data = await (await fetch(file)).arrayBuffer();
   } else if (file instanceof File || file instanceof Blob) {

tests/core/security/network.test.js

@@ -0,0 +1,11 @@
+// The core is built with --disable-network: untrusted arguments or playlists
+// can't make it open connections (it used to emulate sockets with WebSockets).
+import { expect } from "vitest";
+import { test } from "../../helpers/core.js";
+import { exec } from "../../helpers/run.js";
+
+test.for(["http://127.0.0.1:9/x.mp4", "tcp://127.0.0.1:9", "rtmp://127.0.0.1/x"])("refuses %s", (url, { core }) => {
+  const { ret, log } = exec(core, "-i", url, "-f", "null", "-");
+  expect(ret).to.not.equal(0);
+  expect(log).to.match(/Protocol not found|No such file|Invalid argument/);
+});

tests/ffmpeg/mount/workerfs.test.js

@@ -17,7 +17,8 @@ test("mounts Files and Blobs with WORKERFS and ffmpeg reads them", async ({ ffmp
   expect((await ffmpeg.listDir(mnt)).map((n) => n.name)).to.deep.equal([".", ".."]);
 });
 
-test("returns false for an unknown file system", async ({ ffmpeg, dir }) => {
-  await ffmpeg.createDir(`${dir}/m2`);
-  expect(await ffmpeg.mount("NOPEFS", {}, `${dir}/m2`)).to.equal(false);
+// Only the file systems the core links; not arbitrary FS properties.
+test.for(["NOPEFS", "__proto__", "constructor"])("returns false for the file system %s", async (fsType, { ffmpeg, dir }) => {
+  await ffmpeg.createDir(`${dir}/m`);
+  expect(await ffmpeg.mount(fsType, {}, `${dir}/m`)).to.equal(false);
 });