# FFmpeg Media Threat Model (STRIDE)

## Scope

This threat model covers the FFmpeg Media module and submodules in this repository:

- API endpoints (`/api/ffmpeg-media/*`)
- FFmpeg UI AJAX/SSE endpoints (`/ffmpeg-media/ajax/*`, `/ffmpeg-media/sse/*`)
- Conversion queue and FFmpeg command execution pipeline
- CDN upload integration and credentials

## Security Objectives

1. Prevent command injection and path traversal during conversion.
2. Prevent unauthorized read/write operations via API and admin routes.
3. Prevent SSRF and network pivot via URL ingestion.
4. Protect sensitive configuration and operational metadata.
5. Maintain service availability under malformed input and burst load.

## Assets

- Media source files and converted outputs
- Queue and progress state tables
- FFmpeg/CDN credentials and config
- API responses (health, metrics, progress)
- Admin capabilities (`administer ffmpeg media`, `view ffmpeg media metrics`, `transcode media`)

## Trust Boundaries

1. Browser/client -> Drupal HTTP endpoints
2. Drupal app -> FFmpeg/FFprobe process execution
3. Drupal app -> external URLs for download ingest
4. Drupal app -> CDN provider APIs
5. Internal queue workers/cron -> conversion pipeline

## STRIDE Analysis

| Category | Primary Risk | Existing Controls | Residual Risk |
|---|---|---|---|
| Spoofing | Unauthenticated access to protected metrics/health status | Route permissions + optional probe token on public probes | Misconfigured roles may still overexpose metrics |
| Tampering | Command/argument manipulation | Array-based Process invocation, option validation, plugin-level normalization | Misuse in future custom processors |
| Repudiation | Missing forensic trace for destructive actions | Drupal logs + module channel logging for conversion/CDN events | Limited cross-request correlation IDs |
| Information Disclosure | Leaking internal details via machine endpoints | Permission checks, probe token mode, hardened response headers | Environment misconfiguration can expose metadata |
| Denial of Service | Queue/API saturation, expensive refresh loops | Queue limits, configurable refresh interval, circuit breaker | Burst load can still degrade latency without infra limits |
| Elevation of Privilege | Accessing transcode or output-management actions without rights | Granular permissions + entity access checks + CSRF on POST AJAX | Privilege creep via role aggregation over time |

## Abuse Cases and Mitigations

### 1) Response sniffing/clickjacking on API-like endpoints

- Mitigations:
  - centralized header hardening subscriber
  - `nosniff`, `DENY`, strict CSP (`default-src 'none'`)
  - no-store cache directives for machine endpoints
- Verification:
  - E2E assertions in `tests/e2e/api.spec.ts`
  - smoke script: `npm run security:smoke`

### 2) Unauthorized metrics scraping

- Mitigations:
  - explicit permission `view ffmpeg media metrics`
  - negative access tests in E2E + smoke checks

### 3) Queue flooding / degraded UX

- Mitigations:
  - queue manager limits
  - refresh interval controls and adaptive refresh logic
  - performance benchmark harness with p95/p99 tracking

## Residual Risks and Next Hardening Steps

1. Add optional rate-limiting/WAF rules for `/api/ffmpeg-media/*`.
2. Add audit log correlation ID per conversion request.
3. Add chaos/load runs in CI nightly (not per-PR) with budget thresholds.
4. Add periodic role-permission review checklist for prod.

