Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Require operator authority for Music Video ffmpeg render dispatch

Closed
  • Is something wrong?
#12,514 0 comments 0 reactions 1 assignee View on GitHub

Maintainers usually reply within 1 day

@atomantic is already working on this.

Since Oct 20, 2026.

  • #12528 by @atomantic — merged

Assessment

This issue has not been assessed yet.

Description

effort:low in-progress model:light plan planner:opus-5-5 security

Audit slice: uploaded media reaching ffmpeg, and the routes that dispatch ffmpeg renders (security audit, 2026-10-20).

Problem

Five Music Video routes start an ffmpeg render or encode job on the host and are not in HOST_CONTROL_ROUTES (server/lib/hostControlRoutes.js):

Route Handler ffmpeg sink
POST /api/music-video/:id/render server/routes/musicVideo.js:714 services/musicVideo/render.js (final render, spawn)
POST /api/music-video/:id/shots/:sceneId/render server/routes/musicVideo.js:740 services/musicVideo/shotSegments.js:307 (runFfmpegProcess)
POST /api/music-video/:id/shot-renders/preview server/routes/musicVideo.js:750 services/musicVideo/shotSegments.js:400 (concat with the song)
POST /api/music-video/:id/excerpt server/routes/musicVideo.js:1033 services/musicVideo/excerptRender.js:413 (spawn)
POST /api/music-video/:id/publish-kit/build server/routes/musicVideo.js:1041 services/musicVideo/publishKit.js:189,200 (platform encodes, thumbnails)

The sibling ffmpeg render dispatches are already gated as host control: video stitch and upscale (#11076, hostControlRoutes.js:621-623), trim-start (#11418, :624-625) and the Video Timeline render (#11432, :626-627). The file's own criterion is that a route belongs in the list when it runs a process on the host.

Impact: on a password-free install any LAN or tailnet caller, and any scoped peer credential, can start these long ffmpeg jobs over the project's master audio and clips. The master audio is whatever was uploaded through the ungated track or vocal-stem upload. The same audit fixed the worst consequence of that combination at ingest: ffmpeg 4.4 and 5.1 (Ubuntu 22.04, Debian 12) opened an uploaded .mp3 that was really an HLS playlist and read the local media file it named into the render. Ingest now refuses such files (detectMediaManifest, server/lib/mimeTypes.js). What remains is unauthorized host process execution, the same class #11432 closed for the timeline. Severity 2.

Decided fix

Add the five routes above to HOST_CONTROL_ROUTES in a "Music Video ffmpeg renders" block beside the #11432 timeline entry, with a one-line comment naming the ffmpeg sink. These stay open:

  • the cancel routes, because they reduce execution
  • GET status and SSE event routes
  • POST /:id/render-cleanup, which deletes PortOS's own render caches
  • POST /:id/analyze, which is a bounded ingest decode like the upload thumbnail and duration probes

Autonomous production runs call renderMusicVideo and startShotRender in-process from routes that are already gated, so they are unaffected. Local operators, signed-in sessions and agents with PORTOS_API_TOKEN keep every render.

Acceptance criteria

  • server/routes/hostControlMediaProcessing.test.js (or a new hostControlMusicVideoRender.test.js in the same shape) proves all five routes are refused for a remote caller on a password-free install and for a peer credential, and are still dispatched for a local connection and an operator/agent session.
  • docs/API.md notes the gate where it documents these routes.

Scope: small. model:light because it is a list edit plus a test file that copies an existing pattern. effort:low because the route set is decided here.

Dominant language
JavaScript
Stars
38
Forks
32
Avg merge
35m
Merged PRs (30d)
993

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from atomantic/PortOS

All issues in atomantic/PortOS

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.