From af6c7b36997e87b93e24fd055e9c0b640f8abaef Mon Sep 17 00:00:00 2001
From: pablu <me@pablu.de>
Date: Thu, 6 Aug 2026 10:58:29 +0200
Subject: [PATCH] feat: add https safe file handling

---
 generator.go | 20 +++++++++++++++++---
 mise.toml    |  8 ++++++++
 2 files changed, 25 insertions(+), 3 deletions(-)
 create mode 100644 mise.toml

diff --git a/generator.go b/generator.go
index 5710a2c..2bb293b 100644
--- a/generator.go
+++ b/generator.go
@@ -61,11 +61,11 @@ func (opts *Options) GetThumbnail(path string) ([][]byte, int, error) {
 		return nil, 0, err
 	}
 
-	var interval int 
+	var interval int
 	if opts.UseSegments {
 		interval = int(length / float64(opts.Segments))
 	} else {
-    interval = opts.Interval
+		interval = opts.Interval
 	}
 
 	return GetThumbnailUnderlying(path, opts.MaxThumbnails, filters, length, interval, opts.EnableFilter, opts.Format, opts.Scale)
@@ -148,9 +148,23 @@ func GetVideoLength(path string) (float64, error) {
 	return strconv.ParseFloat(strings.ReplaceAll(buf.String(), "\n", ""), 64)
 }
 
+func escapeFilterValue(value string) string {
+	return strings.NewReplacer(
+		"\\", "\\\\",
+		"'", "\\'",
+		":", "\\:",
+		",", "\\,",
+		";", "\\;",
+		"[", "\\[",
+		"]", "\\]",
+	).Replace(value)
+}
+
 func GetFilter(path string) ([]TimeFilter, error) {
 	buf := bytes.NewBuffer(nil)
-	cmd := exec.Command("ffprobe", "-f", "lavfi", "-i", fmt.Sprintf("movie=%s,blackdetect[out0]", path), "-show_entries", "tags=lavfi.black_start,lavfi.black_end", "-of", "default=nw=1", "-v", "quiet")
+	filter := fmt.Sprintf("movie=filename='%s',blackdetect[out0]", escapeFilterValue(path))
+
+	cmd := exec.Command("ffprobe", "-f", "lavfi", "-i", filter, "-show_entries", "tags=lavfi.black_start,lavfi.black_end", "-of", "default=nw=1", "-v", "quiet")
 	cmd.Stdout = buf
 	err := cmd.Run()
 	// TODO: Replace with strings.Builder
diff --git a/mise.toml b/mise.toml
new file mode 100644
index 0000000..7fc8548
--- /dev/null
+++ b/mise.toml
@@ -0,0 +1,8 @@
+[tools]
+go = "1.26.0"
+"go:golang.org/x/tools/gopls" = "latest"
+buf = "1.72.0"
+
+[tasks.generate]
+description = "Generate Go protobuf and gRPC bindings"
+run = "buf generate"