WowzaMediaServer StorageDir Constraint Bypass

`Product: Wowza Media Server  
URL: http://www.wowza.com/  
Description: WMS is a quite popular RTMP/HLS/HDS/RTSP streaming server  
  
Issue:  
  
In early 2009 I reported problem with processing of requests with  
relative paths.  
  
The issue surfaced again.  
  
In a nutshell, you can escape Applications StorageDir using relative  
path.  
  
Lets say you have two applications:  
  
* vod1 with /usr/local/WowzaMediaServer/content1/ as StorageDir  
* vod2 with /usr/local/WowzaMediaServer/content2/ as StorageDir  
  
Requesting to play `mp4:../content1/file.mp4` from `vod2` will work  
just fine thus bypassing configured StorageDir.  
  
Possible workarounds:  
  
* Implement custom module that supplies either  
`IMediaStreamNameAliasProvider2` or `IMediaStreamFileMapper` override  
which blocks requests falling outside configured `StorageDir`  
* Use StreamNameAlias module to block requests with relative paths  
* Upgrade to Wowza 3.5.2.06 (patch that hopefully fixes this issue)  
* Don't use predictable paths  
  
Timeline:  
  
* 2013-04-06 Wowza Media Services contacted about this issue  
* 2013-04-08 Wowza acknowledges this bug, no further info received  
* 2013-04-30 Public release due to vendor's non-cooperation  
  
M.  
--  
Michal J. <wejn(at)box.cz>  
"I honestly think it is better to be a failure at something you love  
than to be a success at something you hate..." -- George Burns  
`