@streamscloud/kit 0.84.0 → 0.84.1

package/dist/core/files/file-helper.d.ts

@@ -28,10 +28,11 @@ export declare class FileHelper {
      * Checks a file's real type against its declared one. The bytes identify images (PNG, JPEG, WebP, GIF, AVIF, HEIC, SVG),
      * MP4, audio (WAV, MP3, M4A, AAC, FLAC), PDF, DOCX, XLSX, ZIP and fonts (WOFF2, WOFF, TTF, OTF); other formats are typed
      * as declared. An equivalent extension (`.jpeg` for `jpg`) and any member of the declared ISO media container family
-     * (`.m4a` holding an `isom` MP4, `.heif` for HEIC) is a match, as is any ZIP archive named `.zip`. When the name lacks
-     * the right extension, it is appended and the original name stays intact: `photo.jpg` holding a PNG → `photo.jpg.png`.
-     * Binary formats read only the head; SVG is looked for only when something is declared, and a markup-looking file is
-     * then read whole to confirm an SVG root.
+     * (`.m4a` holding an `isom` MP4, `.heif` for HEIC) is a match, as is a declared ZIP, PNG or font whose header carries its
+     * format's signature (any ZIP, APNG, Apple `true` TrueType, WOFF / WOFF2 of any flavor). When the name lacks the right
+     * extension, it is appended and the original name stays intact: `photo.jpg` holding a PNG → `photo.jpg.png`. Binary
+     * formats read only the head; SVG is looked for only when something is declared, and a markup-looking file is then read
+     * whole to confirm an SVG root.
      */
     static checkType(file: File): Promise<FileTypeCheck>;
     static truncateFileName(fileName: string, maxNameLength: number | null | undefined): string;

package/dist/core/files/file-helper.js

@@ -23,17 +23,19 @@ const CONTENT_DETECTABLE_EXTENSIONS = new Set([
     'otf'
 ]);
 const PREFERRED_EXTENSIONS = { 'video/quicktime': 'mov', 'audio/mpeg': 'mp3', 'audio/aac': 'aac', 'audio/flac': 'flac' };
+const PREFERRED_TYPES = { flac: 'audio/flac' };
+const typeOf = (extension) => PREFERRED_TYPES[extension] ?? mime.getType(extension);
 const SVG_TYPE = { mime: 'image/svg+xml', extension: 'svg' };
 const ISO_MEDIA_CONTAINERS = [new Set(['mp4', 'm4v', 'm4a', 'm4b', 'mov', '3gp', '3g2', 'f4v']), new Set(['heic', 'heif'])];
-const CONTENT_DETECTABLE_MIMES = new Set([...CONTENT_DETECTABLE_EXTENSIONS, 'svg', ...ISO_MEDIA_CONTAINERS.flatMap((family) => [...family])].map((extension) => mime.getType(extension)));
+const CONTENT_DETECTABLE_MIMES = new Set([...CONTENT_DETECTABLE_EXTENSIONS, 'svg', ...ISO_MEDIA_CONTAINERS.flatMap((family) => [...family])].map(typeOf));
 const sameFormat = (extensionA, extensionB) => {
-    const type = mime.getType(extensionA);
-    return type !== null && type === mime.getType(extensionB);
+    const type = typeOf(extensionA);
+    return type !== null && type === typeOf(extensionB);
 };
 const sameContainer = (extensionA, extensionB) => ISO_MEDIA_CONTAINERS.some((family) => family.has(extensionA) && family.has(extensionB));
 const declaredType = (file) => {
     const extension = FileHelper.getFileExtension(file.name).toLowerCase();
-    const fromName = extension ? mime.getType(extension) : null;
+    const fromName = extension ? typeOf(extension) : null;
     if (fromName) {
         return { mime: fromName, extension, fromName: true };
     }
@@ -47,9 +49,28 @@ const startsWithMarkup = async (blob) => {
     return head.trimStart().startsWith('<');
 };
 const isSvgDocument = async (blob) => (await startsWithMarkup(blob)) && HtmlHelper.sanitizeSvg(await blob.text()) !== null;
-const isZipArchive = async (blob) => (await blob.slice(0, 4).text()) === 'PK\u0003\u0004';
+const DECLARED_SIGNATURES = {
+    zip: [[0x50, 0x4b, 0x03, 0x04]],
+    png: [[0x89, 0x50, 0x4e, 0x47]],
+    ttf: [
+        [0x00, 0x01, 0x00, 0x00],
+        [0x74, 0x72, 0x75, 0x65]
+    ],
+    otf: [[0x4f, 0x54, 0x54, 0x4f]],
+    woff: [[0x77, 0x4f, 0x46, 0x46]],
+    woff2: [[0x77, 0x4f, 0x46, 0x32]]
+};
+const SIGNATURE_BYTES = 4;
+const hasDeclaredSignature = async (blob, extension) => {
+    const signatures = DECLARED_SIGNATURES[extension];
+    if (!signatures) {
+        return false;
+    }
+    const head = new Uint8Array(await blob.slice(0, SIGNATURE_BYTES).arrayBuffer());
+    return signatures.some((signature) => signature.every((byte, index) => head[index] === byte));
+};
 const contentType = async (blob, declared) => {
-    if (declared?.extension === 'zip' && (await isZipArchive(blob))) {
+    if (declared && (await hasDeclaredSignature(blob, declared.extension))) {
         return declared;
     }
     const { fileTypeFromBlob } = await import('file-type');
@@ -57,7 +78,7 @@ const contentType = async (blob, declared) => {
     if (detected && declared && sameContainer(detected.ext, declared.extension)) {
         return declared;
     }
-    const detectedMime = detected && CONTENT_DETECTABLE_EXTENSIONS.has(detected.ext) ? mime.getType(detected.ext) : null;
+    const detectedMime = detected && CONTENT_DETECTABLE_EXTENSIONS.has(detected.ext) ? typeOf(detected.ext) : null;
     if (detected && detectedMime) {
         return { mime: detectedMime, extension: detected.ext };
     }
@@ -83,10 +104,11 @@ export class FileHelper {
      * Checks a file's real type against its declared one. The bytes identify images (PNG, JPEG, WebP, GIF, AVIF, HEIC, SVG),
      * MP4, audio (WAV, MP3, M4A, AAC, FLAC), PDF, DOCX, XLSX, ZIP and fonts (WOFF2, WOFF, TTF, OTF); other formats are typed
      * as declared. An equivalent extension (`.jpeg` for `jpg`) and any member of the declared ISO media container family
-     * (`.m4a` holding an `isom` MP4, `.heif` for HEIC) is a match, as is any ZIP archive named `.zip`. When the name lacks
-     * the right extension, it is appended and the original name stays intact: `photo.jpg` holding a PNG → `photo.jpg.png`.
-     * Binary formats read only the head; SVG is looked for only when something is declared, and a markup-looking file is
-     * then read whole to confirm an SVG root.
+     * (`.m4a` holding an `isom` MP4, `.heif` for HEIC) is a match, as is a declared ZIP, PNG or font whose header carries its
+     * format's signature (any ZIP, APNG, Apple `true` TrueType, WOFF / WOFF2 of any flavor). When the name lacks the right
+     * extension, it is appended and the original name stays intact: `photo.jpg` holding a PNG → `photo.jpg.png`. Binary
+     * formats read only the head; SVG is looked for only when something is declared, and a markup-looking file is then read
+     * whole to confirm an SVG root.
      */
     static async checkType(file) {
         const declared = declaredType(file);
@@ -101,7 +123,7 @@ export class FileHelper {
         if (!declared) {
             return { status: 'unknown' };
         }
-        if (CONTENT_DETECTABLE_MIMES.has(mime.getType(declared.extension))) {
+        if (CONTENT_DETECTABLE_MIMES.has(typeOf(declared.extension))) {
             return { status: 'contradicted', declaredExtension: declared.extension };
         }
         return { status: 'unverifiable', file: retyped(file, declared.fromName ? file.name : appended(declared.extension), declared.mime) };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@streamscloud/kit",
-  "version": "0.84.0",
+  "version": "0.84.1",
   "author": "StreamsCloud",
   "repository": {
     "type": "git",