[Bug 22901] Clarification regarding a potential CDM capable of running arbitrary code

https://www.w3.org/Bugs/Public/show_bug.cgi?id=22901

Glenn Adams <glenn@skynav.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
                 CC|                            |glenn@skynav.com
         Resolution|---                         |NEEDSINFO

--- Comment #1 from Glenn Adams <glenn@skynav.com> ---
(In reply to comment #0)
> From my reading of the EME draft, it seems that a CDM which can run
> arbitrary code embedded into the media stream would currently be standard
> compliant. 
> 
> Furthermore, the stream of the media_element and the message interface from
> EME provide a bi-directional link between an arbitrary server and a
> (potentially hijacked) CDM, which runs with the same privileges as the
> user-agent. This poses a potential thread to the security of the user's
> system.

No for two reasons:

(1) code is not embedded in a media stream;
(2) the function of the CDM is not to execute code (whether embedded in the
stream or not), but to decrypt media content from the media stream;

What specific language in the specification makes you think it does either of
these?

-- 
You are receiving this mail because:
You are the QA Contact for the bug.

Received on Thursday, 8 August 2013 08:02:18 UTC