DVDDemuxFFmpeg: New addon setting to set ffmpeg option 'extension_picky'

[vpeter4]

allows to play HLS stream without extension in url
related to FFmpeg/FFmpeg@b753bac

2025-10-16 18:51:56.563 T:885 error <general>: ffmpeg[0x6ff2e90]: [hls] URL https://some.server.com/stream/fragment/ts/live/?session=163ec3ad-7f2e-4f16-be20-062a73733b56&offset=192639&pointeroffset=39&fragmentlength=4800 is not in allowed_extensions

[vpeter4]

I forgot to wrote that I'm not really sure how to pass this options from m3u8 list to ffmpeg?
I put |extension_picky at the end of url and this set the value to 0. But I don't know how to set to 1? And in case of allowed_extensions how to set value ALL? Because |allowed_extensions=ALL didn't work.

In my opinion this should be addon setting? Like "Disable strict HLS file extension check" and "Allowed HLS extensions". It is annoying to fix all channels when it can be done on one place only.

[phunkyfish]

Is this good to go now?

[vpeter4]

It is.

But in my opinion it would be better to put this extension_picky to addon setting like Disable strict HLS file extension check as boolean. I can try to add there tomorrow if you would accept such solution. If not merge this pr.

Option allowed_extensions can't really test because I don't have any link to test. But I assume it is ok as is.

[vpeter4]

Or maybe even better would be to just set option explicitly because user want to play stream regardless of such restriction in ffmpeg. And manually allowing this option to enable playing of the stream doesn't fix any security concern.

av_dict_set(&options, "extension_picky", "0", 0);

but because of security implications maybe not best GHSA-398c-f7w9-crc8

[vpeter4]

Maybe adding to addon settings would be prefered way because disabling extension check does have some security implications. That's why this change in ffmpeg was even made: GHSA-398c-f7w9-crc8

Like this with default setting off.

[phunkyfish]

So the default is secure? We should update the help text to inform users that disabling it is less secure.

[vpeter4]

Yes, default is secured and that's why play fails because now is more restricted.

Text like this? Or you have better suggestion.
Allows playing HLS streams without file extension or with unsuported file extension. This lowers the security requirements in ffmpeg.

How are this new strings added to addon? I see translations here https://kodi.weblate.cloud/projects/kodi-add-ons-videoplayer-inputstream/inputstream-ffmpegdirect/.

[phunkyfish]

Yes. That text is good.

once released weblate will provide the new strings for translation.

we only add eb_gb to the repo, weblate manages everything else.

[vpeter4]

Updated PR with new addon option.
Tested and it works as it should.