fix(media): bound the copilot ffmpeg tool's inputs, runtime, and output paths - #6544

Open

waleedlatif1 wants to merge 8 commits into

security/ffmpeg-media-tool-limits

Commits on Aug 11, 2026

fix(media): bound the copilot ffmpeg tool's inputs, runtime, and output paths
waleedlatif1
committed
4dc5a67
fix(media): address ffmpeg hardening review findings
waleedlatif1
committed
260abe8
refactor(media): reuse shared execution limits and give each rule one home
waleedlatif1
committed
9791fd8
chore(media): drop comments that restate the code they annotate
waleedlatif1
committed
acc3c6d
fix(media): let a host with only ffprobe still probe
waleedlatif1
committed
79d78e5
fix(media): drop weba from the output allowlist
waleedlatif1
committed
4560e5a
fix(media): look ffprobe up on PATH before ffmpeg's sibling
waleedlatif1
committed
6c7a25e
fix(media): floor the probe timeout and label audio-only webm correctly
waleedlatif1
committed
dc6cc8b