src/media.ts

Functions

Imports

It imports src/contract.ts. Imported by src/server/media.ts.

Source

1// The upload checks the package makes before a site sees a byte (v0.2.0): the declared type must be
2// one the site accepts, the body may not exceed the site's limit (read no further than that), and
3// the bytes must look like the declared type where the type has a signature. The site's own checks
4// (measuring an image, its storage) come after these, never instead of them.
5
6import type { MediaUploadLimits } from "./contract.js";
7
8/** The media type without parameters, lower case: "image/png; x=1" is "image/png". */
9export function essence(contentType: string | null): string {
10  return (contentType ?? "").split(";")[0]!.trim().toLowerCase();
11}
12
13type UploadRefusal = { code: "invalid" | "too-large"; message: string };
14
15/**
16 * Reads the body up to `limits.maxBytes` and stops: a declared or actual size over the limit is
17 * refused without buffering the rest.
18 */
19export async function readUpload(
20  request: Request,
21  limits: MediaUploadLimits,
22): Promise<{ ok: true; bytes: Uint8Array } | { ok: false; refusal: UploadRefusal }> {
23  const tooLarge: UploadRefusal = { code: "too-large", message: `The file is larger than this site accepts (${limits.maxBytes} bytes).` };
24  const declared = Number(request.headers.get("content-length") ?? "0");
25  if (declared > limits.maxBytes) return { ok: false, refusal: tooLarge };
26  if (!request.body) return { ok: false, refusal: { code: "invalid", message: "The upload is empty." } };
27
28  const reader = request.body.getReader();
29  const chunks: Uint8Array[] = [];
30  let total = 0;
31  for (;;) {
32    const { done, value } = await reader.read();
33    if (done) break;
34    total += value.byteLength;
35    if (total > limits.maxBytes) {
36      await reader.cancel().catch(() => {});
37      return { ok: false, refusal: tooLarge };
38    }
39    chunks.push(value);
40  }
41  if (total === 0) return { ok: false, refusal: { code: "invalid", message: "The upload is empty." } };
42  const bytes = new Uint8Array(total);
43  let at = 0;
44  for (const chunk of chunks) {
45    bytes.set(chunk, at);
46    at += chunk.byteLength;
47  }
48  return { ok: true, bytes };
49}
50
51const ascii = (bytes: Uint8Array, from: number, length: number) => String.fromCharCode(...bytes.subarray(from, from + length));
52
53/**
54 * The signature each known type's bytes must carry. A type with no entry here is the site's to
55 * check; the package cannot tell what it should look like.
56 */
57const SIGNATURES: Record<string, (b: Uint8Array) => boolean> = {
58  "image/png": (b) => [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a].every((v, i) => b[i] === v),
59  "image/jpeg": (b) => b[0] === 0xff && b[1] === 0xd8 && b[2] === 0xff,
60  "image/gif": (b) => ascii(b, 0, 6) === "GIF87a" || ascii(b, 0, 6) === "GIF89a",
61  "image/webp": (b) => ascii(b, 0, 4) === "RIFF" && ascii(b, 8, 4) === "WEBP",
62  "image/avif": (b) => ascii(b, 4, 4) === "ftyp" && /avi[fs]/.test(ascii(b, 8, 24)),
63  "application/pdf": (b) => ascii(b, 0, 5) === "%PDF-",
64  // Text, so no magic number: no NUL byte in the head, and an <svg element near the start.
65  "image/svg+xml": (b) => {
66    const head = new TextDecoder().decode(b.subarray(0, 4096));
67    return !head.includes("\u0000") && /^?\s*</.test(head) && /<svg[\s>]/i.test(head);
68  },
69};
70
71/**
72 * Content that runs when a site serves the file from its own origin: script, event handlers, embedded documents and
73 * javascript: links in an SVG, and JavaScript actions in a PDF. Such a file is refused rather than cleaned, since the
74 * package does not rewrite what an editor uploads.
75 */
76const ACTIVE: Record<string, (b: Uint8Array) => boolean> = {
77  "image/svg+xml": (b) =>
78    /<script\b|[\s/"']on[a-z]+\s*=|<foreignObject\b|<(iframe|embed|object)\b|javascript:|href\s*=\s*["']\s*&#/i.test(new TextDecoder().decode(b)),
79  "application/pdf": (b) => /\/(JS|JavaScript)\b/.test(new TextDecoder().decode(b)),
80};
81
82/** Refuses a type the site does not accept, and bytes that are not what the type claims. */
83export function checkUpload(contentType: string, bytes: Uint8Array | null, limits: MediaUploadLimits): UploadRefusal | null {
84  const types = limits.types.map((t) => t.toLowerCase());
85  if (!types.includes(contentType)) {
86    return { code: "invalid", message: `This site does not accept ${contentType || "a file with no type"}. It accepts ${types.join(", ")}.` };
87  }
88  if (bytes) {
89    const signed = SIGNATURES[contentType];
90    if (signed && !signed(bytes)) return { code: "invalid", message: `The file is not a ${contentType}: its bytes do not match the type it was sent as.` };
91    if (ACTIVE[contentType]?.(bytes)) return { code: "invalid", message: `The ${contentType} file holds script or an embedded page, which would run on the site. Export it without them.` };
92  }
93  return null;
94}