fix: validate recording output paths (#1755)

* Validate recording output directories

* fix: report unsafe recording paths distinctly from invalid ones

Splitting the empty-path and os_is_path_safe() checks lets the IPC error
and the log line say which one tripped, so a rejected symlink/junction
directory is diagnosable instead of just "Invalid recording path."

Also switch osn-encoders.hpp to a quoted include, matching every other
consumer of that header.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: summeroff

obs-studio-server/source/osn-advanced-recording.cpp

@@ -21,7 +21,8 @@
 #include "shared.hpp"
 #include "osn-audio-track.hpp"
 #include "osn-file-output.hpp"
-#include <osn-encoders.hpp>
+#include "osn-encoders.hpp"
+#include <util/platform.h>
 
 void osn::IAdvancedRecording::Register(ipc::server &srv)
 {
@@ -282,6 +283,14 @@ void osn::IAdvancedRecording::Start(void *data, const int64_t id, const std::vec
 
 	obs_output_set_video_encoder(recording->GetOutput(), recording->videoEncoder);
 
+	if (!recording->path.size()) {
+		PRETTY_ERROR_RETURN(ErrorCode::InvalidReference, "Invalid recording path.");
+	}
+
+	if (!os_is_path_safe(recording->path.c_str())) {
+		PRETTY_ERROR_RETURN(ErrorCode::InvalidReference, "Unsafe recording path: symbolic links and junctions are not allowed.");
+	}
+
 	std::string path = recording->path;
 
 	char lastChar = path.back();

obs-studio-server/source/osn-advanced-replay-buffer.cpp

@@ -22,6 +22,7 @@
 #include "shared.hpp"
 #include "osn-audio-track.hpp"
 #include "osn-encoders.hpp"
+#include <util/platform.h>
 
 void osn::IAdvancedReplayBuffer::Register(ipc::server &srv)
 {
@@ -205,6 +206,10 @@ void osn::IAdvancedReplayBuffer::Start(void *data, const int64_t id, const std::
 		PRETTY_ERROR_RETURN(ErrorCode::InvalidReference, "Invalid recording path.");
 	}
 
+	if (!os_is_path_safe(replayBuffer->path.c_str())) {
+		PRETTY_ERROR_RETURN(ErrorCode::InvalidReference, "Unsafe recording path: symbolic links and junctions are not allowed.");
+	}
+
 	const char *rbPrefix = replayBuffer->prefix.c_str();
 	const char *rbSuffix = replayBuffer->suffix.c_str();
 	int64_t rbSize = replayBuffer->usesStream ? 0 : 512;

obs-studio-server/source/osn-simple-recording.cpp

@@ -24,6 +24,7 @@
 #include "nodeobs_audio_encoders.h"
 #include "osn-file-output.hpp"
 #include "osn-encoders.hpp"
+#include <util/platform.h>
 
 void osn::ISimpleRecording::Register(ipc::server &srv)
 {
@@ -401,6 +402,10 @@ void osn::ISimpleRecording::Start(void *data, const int64_t id, const std::vecto
 		PRETTY_ERROR_RETURN(ErrorCode::InvalidReference, "Invalid recording path.");
 	}
 
+	if (!os_is_path_safe(recording->path.c_str())) {
+		PRETTY_ERROR_RETURN(ErrorCode::InvalidReference, "Unsafe recording path: symbolic links and junctions are not allowed.");
+	}
+
 	std::string path = recording->path;
 
 	char lastChar = path.back();

obs-studio-server/source/osn-simple-replay-buffer.cpp

@@ -22,6 +22,7 @@
 #include "shared.hpp"
 #include "nodeobs_audio_encoders.h"
 #include "osn-encoders.hpp"
+#include <util/platform.h>
 
 void osn::ISimpleReplayBuffer::Register(ipc::server &srv)
 {
@@ -147,6 +148,10 @@ void osn::ISimpleReplayBuffer::Start(void *data, const int64_t id, const std::ve
 		PRETTY_ERROR_RETURN(ErrorCode::InvalidReference, "Invalid recording path.");
 	}
 
+	if (!os_is_path_safe(replayBuffer->path.c_str())) {
+		PRETTY_ERROR_RETURN(ErrorCode::InvalidReference, "Unsafe recording path: symbolic links and junctions are not allowed.");
+	}
+
 	const char *rbPrefix = replayBuffer->prefix.c_str();
 	const char *rbSuffix = replayBuffer->suffix.c_str();
 	int64_t rbSize = replayBuffer->usesStream ? 0 : 512;
@@ -312,4 +317,4 @@ void osn::ISimpleReplayBuffer::SetRecording(void *data, const int64_t id, const
 
 	rval.push_back(ipc::value((uint64_t)ErrorCode::Ok));
 	AUTO_DEBUG;
-}
+}