LowganDev--PlayfinPS4/docs/security.md

Security notes

Network

• HTTPS certificates are verified against the Mozilla CA list shipped in resources/certs/cacert.pem (the console's own list can be outdated).
• Self-signed servers: trust on first use. The app shows the SHA-256 fingerprint of the server's public key; once accepted, that exact key is pinned (servers.json) and any other key is refused, even one signed by a known CA. A changed key is refused (TLS error telling the user to add the server again); trusting the new key takes that explicit re-add. Saved tokens are only sent to addresses the server was already known by: a new address (for example a discovery reply carrying a known server id) needs a sign-in there first. When an address has several candidates (https/http, default ports), an untrusted certificate is offered only if no candidate answers as Jellyfin.
• Redirects never go from https to http; API (JSON) replies are limited to 8 MiB, files (Client::fetch) to 64 MiB; requests time out.
• Discovery keeps at most 32 servers and ignores replies with an id or name over 128 bytes or an address over 512 bytes.
• The access token travels only in the Authorization header, never in URLs (images included), and Client::fetch refuses to send it to another host.

Storage

• servers.json (data folder, mode 0600, atomic writes) holds server addresses, pins, user names and access tokens. Passwords are never stored.
• The PS4 has no secure storage: anyone with file access to the console can read the tokens. If a console is lost, revoke its session in the Jellyfin dashboard (Devices).
• Without a data folder, or when servers.json cannot be read, the app runs without saving and never overwrites the file.
• The app writes only inside its data folder (/data/Playfin on PS4); every path goes through core::dataPath().

Logs

• Every log line is redacted (core::redact): API keys, tokens, Authorization headers, password fields and the Quick Connect secret are replaced by ***. Request bodies are never logged.

Testing

• Server replies, discovery packets, addresses and log redaction are fuzzed (linux-fuzz preset).

Review

A review of the whole code. Threats considered: someone on the network (Wi-Fi, LAN), a malicious or compromised server, a malicious media file served by a trusted server (downloaded content), other homebrew on the console.

Area	Finding	Action
Pictures from the server	NanoVG's bundled stb_image was v2.10 (2016). Fuzzing decodeImage (fuzz_image) found an out-of-bounds write in its JPEG Huffman table code within minutes: a server could crash the app, or worse, with a crafted picture. Every decoder of stb_image was compiled in (PSD, GIF, HDR…).	stb_image 2.30 (upstream 2c980bb), only the JPEG and PNG decoders (STBI_ONLY_JPEG, STBI_ONLY_PNG), STBI_MAX_DIMENSIONS 4096 on top of the existing header check (4096 px a side, 8 Mpx: a progressive JPEG needs about 13 bytes per pixel while it decodes, two decodes at once on the PS4). The crashing file is a regression test (images_test, ASan) and a fuzz seed. 5 minutes of fuzzing without a finding after the change.
Subtitles (libass)	The PS4 image's libass 0.14.0 has CVE-2020-24994 and CVE-2020-26682 (crafted ASS subtitles overflowing the outline code).	libass 0.17.3 built by scripts/ps4/libass (with HarfBuzz 11.2.1, scripts/ps4/harfbuzz, required since libass 0.15).
Fonts (FreeType)	The image's FreeType 2.10.1 has CVE-2020-15999 (heap overflow on PNG glyphs, exploited in the wild in 2020). Fonts attached to media files reached FreeType through libass.	mpv runs with embeddedfonts=no (only Playfin's fonts reach FreeType), and FreeType 2.13.3 is built by scripts/ps4/freetype without bzip2, PNG glyphs, brotli or HarfBuzz (libpng 1.6.37 is no longer linked).
FFmpeg's bzip2	FFmpeg was built with bzlib against the image's bzip2 1.0.6 (CVE-2016-3189, CVE-2019-12900), reachable through bzip2-compressed Matroska tracks.	FFmpeg built with --disable-bzlib; bzip2 is no longer linked.
Player	mpv could read configuration and scripts (already off), and a media file could make it open other files (mov references, playlists).	player::hardeningOptions() (tested): config=no, load-scripts=no, ytdl=no, input-default-bindings=no, embeddedfonts=no, access-references=no, load-unsafe-playlists=no. FFmpeg keeps only the decoders, demuxers and protocols Jellyfin's streams need.
TLS and the token	Verified against the shipped Mozilla list; pinned keys for self-signed servers; the token only in the Authorization header, sent to the server's own origin only (images, streams, transcoding URLs: api_key removed, other hosts refused). FFmpeg cannot check a pin: for a pinned self-signed server mpv streams with tls-verify=no (docs/ps4-notes.md). Plain HTTP servers on the LAN send the token in clear, as every Jellyfin client does.	No change (documented above).
Parsing	JSON replies, discovery packets, URLs, settings, timers: bounded sizes, fuzzed (fuzz_models, fuzz_discovery, fuzz_url).	parseTimers and parseUtc added to fuzz_models.
Files	Writes only in the data folder (core::dataPath), atomic, 0600 for servers.json and settings.json; caches bounded.	No change.
Logs	Redacted (core::redact); request bodies never logged; the access token test of ui_shell.	No change.
Other dependencies	curl 8.22.0, Mbed TLS 3.6.7, FFmpeg 7.1.5, dav1d 1.5.4, zlib 1.3.1 are current. mpv 0.36.0 (2023), SDL2 2.0.18 (PacBrew PS4 port), FriBidi 1.0.4 and libsamplerate 0.1.9 are older: SDL2's published flaws are in loaders Playfin does not use (BMP, WAV); FriBidi's (CVE-2022-25308/25309/25310) are in its command-line tool and in functions libass does not call.	Recorded; to revisit when updating mpv (a newer mpv needs the PS4 patch ported).

The PS4 dependency packages are built from scripts/ps4 by scripts/ps4/build-deps.sh and published on the deps release of the repository (docs/release.md).