upload-safety 0.3.0 → 0.4.0

package/src/media-formats.ts

@@ -1,5 +1,5 @@
 /**
- * Checks and cleans GIF, BMP and ICO images and MP3, WAV, FLAC and Ogg audio without decoding
+ * Checks and cleans GIF, BMP and ICO images and MP3, AAC, WAV, FLAC and Ogg audio without decoding
  * them, in the way `photo-metadata.ts` handles photos: GIF blocks, WAV chunks and FLAC metadata
  * blocks are kept only when known, so comments, XMP and tags are dropped whole while the image
  * and audio data stay byte for byte. BMP, ICO and Ogg only get a structure check: BMP and ICO
@@ -72,6 +72,11 @@ const MPEG_SAMPLE_RATES: Record<number, number[]> = {
 	0: [ 11025, 12000, 8000 ],
 };
 
+const ADTS_HEADER_SIZE = 7;
+const ADTS_HEADER_SIZE_WITH_CRC = 9;
+const ADTS_MAX_FRAMES = 10_000_000;
+const ADTS_SAMPLING_INDEXES = 13;
+
 const RIFF_HEADER_SIZE = 12;
 const RIFF_CHUNK_HEADER_SIZE = 8;
 const WAV_KEPT_CHUNKS = new Set( [ 'fmt ', 'fact', 'data' ] );
@@ -332,6 +337,45 @@ export function stripMp3( content: Buffer ): Buffer | null {
 	return slice( content, start, end );
 }
 
+/** The length of the ADTS frame whose header starts at `offset`, or 0 when it is not a valid header. */
+function adtsFrameLength( bytes: Buffer, offset: number ): number {
+	if ( offset + ADTS_HEADER_SIZE > bytes.length ) {
+		return 0;
+	}
+	const [ first, second, third ] = [ bytes[ offset ], bytes[ offset + 1 ], bytes[ offset + 2 ] ];
+	const layer = ( second >> 1 ) & 3;
+	const headerSize = second & 1 ? ADTS_HEADER_SIZE : ADTS_HEADER_SIZE_WITH_CRC;
+	const samplingIndex = ( third >> 2 ) & 0xf;
+	const length = ( ( bytes[ offset + 3 ] & 3 ) << 11 ) | ( bytes[ offset + 4 ] << 3 ) | ( bytes[ offset + 5 ] >> 5 );
+	if ( first !== 0xff || ( second & 0xf0 ) !== 0xf0 || layer !== 0 || samplingIndex >= ADTS_SAMPLING_INDEXES || length < headerSize ) {
+		return 0;
+	}
+	return length;
+}
+
+/**
+ * The raw ADTS AAC frames without ID3v2, ID3v1, APEv2 and Lyrics3 tags, or null when the audio is not a
+ * run of valid ADTS frames ending exactly at the end of the audio. Every frame header is walked, so nothing
+ * unchecked can sit between frames or after the last one.
+ */
+export function stripAac( content: Buffer ): Buffer | null {
+	const start = skipId3v2( content );
+	if ( start < 0 ) {
+		return null;
+	}
+	const end = findTrailingTags( content, start );
+	const audio = content.subarray( start, end );
+	let offset = 0;
+	for ( let frames = 0; offset < audio.length; frames++ ) {
+		const length = frames < ADTS_MAX_FRAMES ? adtsFrameLength( audio, offset ) : 0;
+		if ( length === 0 || offset + length > audio.length ) {
+			return null;
+		}
+		offset += length;
+	}
+	return audio.length > 0 ? slice( content, start, end ) : null;
+}
+
 function riffChunk( type: string, payload: Buffer ): Buffer {
 	const chunk = Buffer.alloc( RIFF_CHUNK_HEADER_SIZE + payload.length + ( payload.length & 1 ) );
 	chunk.write( type, 0, 'latin1' );

package/src/photo-metadata.ts

@@ -9,8 +9,9 @@
 import { crc32 } from 'node:zlib';
 
 import { stripHeif } from './heif-metadata.js';
-import { checkBmp, checkIco, checkOgg, stripFlac, stripGif, stripMp3, stripWav } from './media-formats.js';
-import { stripIsoMedia, stripWebm } from './video-formats.js';
+import { inspectAsf } from './asf-media.js';
+import { checkBmp, checkIco, checkOgg, stripAac, stripFlac, stripGif, stripMp3, stripWav } from './media-formats.js';
+import { stripAvi, stripIsoMedia, stripMatroska } from './video-formats.js';
 
 import type { AllowedExtension } from './upload-allowlist.js';
 
@@ -346,7 +347,16 @@ export function stripPhotoMetadata( extension: AllowedExtension, bytes: Uint8Arr
 		case 'mov':
 			return stripIsoMedia( content, null );
 		case 'webm':
-			return stripWebm( content );
+			return stripMatroska( content, 'webm' );
+		case 'mkv':
+			return stripMatroska( content, 'matroska' );
+		case 'aac':
+			return stripAac( content );
+		case 'avi':
+			return stripAvi( content );
+		case 'wma':
+		case 'wmv':
+			return inspectAsf( content, extension === 'wmv' ).bytes;
 		default:
 			return bytes;
 	}

package/src/upload-allowlist.ts

@@ -6,6 +6,7 @@
  */
 
 import { inspectGzip, inspectTarArchive, inspectZipArchive } from './archive-content.js';
+import { inspectAsf } from './asf-media.js';
 import { inspectExcelGlobals } from './excel-macro-sheets.js';
 import { readFtypBrands } from './heif-metadata.js';
 import { readOleDirectory, type OleDirectory } from './ole-streams.js';
@@ -20,7 +21,7 @@ import { readZipEntries, readZipEntryData, startsWithBytes, type ZipEntry } from
 export type AllowedExtension =
 	| 'pdf' | 'doc' | 'docx' | 'ppt' | 'pptx' | 'xls' | 'xlsx' | 'odt' | 'ods' | 'odp'
 	| 'jpg' | 'jpeg' | 'png' | 'webp' | 'heic' | 'heif' | 'avif' | 'gif' | 'bmp' | 'ico'
-	| 'mp3' | 'wav' | 'flac' | 'ogg' | 'm4a' | 'mp4' | 'mov' | 'webm'
+	| 'mp3' | 'aac' | 'wav' | 'flac' | 'ogg' | 'm4a' | 'wma' | 'mp4' | 'mov' | 'webm' | 'mkv' | 'avi' | 'wmv'
 	| 'csv' | 'txt' | 'md' | 'rtf' | 'zip' | 'tar' | 'gz' | 'tgz' | 'rar' | '7z';
 
 /**
@@ -35,7 +36,7 @@ export type FormatRisk = 'low' | 'elevated' | 'unchecked';
 /** Magic-byte family an extension's bytes must match; text has no signature and is checked on its own. */
 type MagicFamily =
 	| 'pdf' | 'zip' | 'ole' | 'jpeg' | 'png' | 'webp' | 'isobmff' | 'text' | 'gif' | 'bmp' | 'ico'
-	| 'mp3' | 'wav' | 'flac' | 'ogg' | 'quicktime' | 'webm' | 'rtf' | 'tar' | 'gzip' | 'rar' | '7z';
+	| 'mp3' | 'aac' | 'wav' | 'flac' | 'ogg' | 'quicktime' | 'webm' | 'avi' | 'asf' | 'rtf' | 'tar' | 'gzip' | 'rar' | '7z';
 
 interface AllowedType {
 	extension: AllowedExtension;
@@ -446,6 +447,12 @@ const ALLOWED_TYPES: readonly AllowedType[] = [
 	// Old QuickTime movies have no `ftyp`; the structure is checked when the metadata is removed.
 	{ extension: 'mov', risk: 'low', magic: 'quicktime', mimeTypes: [ 'video/quicktime' ] },
 	{ extension: 'webm', risk: 'low', magic: 'webm', mimeTypes: [ 'video/webm', 'audio/webm' ] },
+	{ extension: 'aac', risk: 'low', magic: 'aac', mimeTypes: [ 'audio/aac', 'audio/x-aac', 'audio/aacp' ] },
+	{ extension: 'mkv', risk: 'low', magic: 'webm', mimeTypes: [ 'video/x-matroska', 'video/matroska', 'audio/x-matroska' ] },
+	{ extension: 'avi', risk: 'low', magic: 'avi', mimeTypes: [ 'video/x-msvideo', 'video/avi', 'video/msvideo' ] },
+	// Windows Media Player runs script commands and opens DRM license URLs in these; both are refused.
+	{ extension: 'wma', risk: 'elevated', magic: 'asf', mimeTypes: [ 'audio/x-ms-wma', 'application/vnd.ms-asf' ] },
+	{ extension: 'wmv', risk: 'elevated', magic: 'asf', mimeTypes: [ 'video/x-ms-wmv', 'video/x-ms-asf', 'application/vnd.ms-asf' ] },
 	// Rendered Markdown may carry raw HTML and `javascript:` links; the file itself is checked as text.
 	{ extension: 'md', risk: 'elevated', magic: 'text', mimeTypes: [ 'text/markdown', 'text/x-markdown', 'text/plain' ] },
 	// A common carrier of OLE exploits; refused on any object, template or DDE field.
@@ -631,6 +638,13 @@ const MAGIC_SIGNATURES: Record<MagicFamily, ( bytes: Uint8Array ) => boolean> =
 	// "RIFF", the size, "WAVE"
 	wav: ( bytes ) => startsWith( bytes, [ 0x52, 0x49, 0x46, 0x46 ] ) && bytes.length >= 12 &&
 		startsWith( bytes.subarray( 8 ), [ 0x57, 0x41, 0x56, 0x45 ] ),
+	// An ID3 tag or an ADTS frame sync (12 bits set, MPEG layer 0)
+	aac: ( bytes ) => startsWith( bytes, [ 0x49, 0x44, 0x33 ] ) || ( bytes.length >= 2 && bytes[ 0 ] === 0xff && ( bytes[ 1 ] & 0xf6 ) === 0xf0 ),
+	// "RIFF", the size, "AVI "
+	avi: ( bytes ) => startsWith( bytes, [ 0x52, 0x49, 0x46, 0x46 ] ) && bytes.length >= 12 &&
+		startsWith( bytes.subarray( 8 ), [ 0x41, 0x56, 0x49, 0x20 ] ),
+	// The ASF Header Object GUID
+	asf: ( bytes ) => startsWith( bytes, [ 0x30, 0x26, 0xb2, 0x75, 0x8e, 0x66, 0xcf, 0x11, 0xa6, 0xd9, 0x00, 0xaa, 0x00, 0x62, 0xce, 0x6c ] ),
 	// "fLaC"
 	flac: ( bytes ) => startsWith( bytes, [ 0x66, 0x4c, 0x61, 0x43 ] ),
 	// "OggS"
@@ -703,6 +717,9 @@ export function inspectFileContent(
 	if ( allowed.magic === 'text' ) {
 		return inspectText( content, allowed.extension === 'csv' );
 	}
+	if ( allowed.magic === 'asf' ) {
+		return inspectAsf( content, allowed.extension === 'wmv' ).verdict;
+	}
 	if ( allowed.magic === 'rtf' ) {
 		return inspectRtf( content );
 	}

package/src/video-formats.ts

@@ -1,9 +1,9 @@
 /**
- * Checks the structure of MP4, MOV, M4A and WebM files and removes their metadata (GPS,
+ * Checks the structure of MP4, MOV, M4A, WebM, Matroska and AVI files and removes their metadata (GPS,
  * titles, cover art, XMP) without moving a byte, so sample offsets and cluster positions stay
  * valid and a large video is not re-encoded. Boxes and elements are overwritten in place:
- * ISOBMFF boxes become `free` boxes with a zeroed payload, WebM elements become `Void`
- * elements of the same length.
+ * ISOBMFF boxes become `free` boxes with a zeroed payload, WebM and Matroska elements become
+ * `Void` elements of the same length and AVI chunks become zeroed `JUNK` chunks.
  *
  * Limitation: metadata stored as samples in a timed metadata track (GoPro GPMF, DJI, Apple
  * `mebx`) lives in `mdat` or in clusters, which are never touched, so it stays.
@@ -121,6 +121,7 @@ const CLUSTER = 0x1f43b675;
 const TITLE = 0x7ba9;
 const VOID = 0xec;
 const WEBM_DOC_TYPE = 'webm';
+const MATROSKA_DOC_TYPE = 'matroska';
 /** The elements a cluster may hold; the first other ID ends a cluster of unknown size. */
 const CLUSTER_CHILDREN: ReadonlySet<number> = new Set( [ 0xe7, 0x5854, 0xa7, 0xab, 0xa3, 0xa0, 0xaf, VOID, 0xbf ] );
 const MAX_VINT_LENGTH = 8;
@@ -219,19 +220,24 @@ function sizeBytes( value: number, width: number ): Buffer {
 }
 
 /**
- * The WebM file with its Tags, Attachments and Title overwritten by `Void` elements of the same
- * length, the input itself when there was nothing to remove, or null when it is not a WebM
- * (`matroska` is refused) or its elements do not read. A cluster of unknown size, as live
+ * The WebM or Matroska file with its Tags, Attachments (in Matroska they can hold any file) and Title
+ * overwritten by `Void` elements of the same length, the input itself when there was nothing to remove,
+ * or null when its DocType is not allowed or its elements do not read. `webm` allows only WebM;
+ * `matroska` allows both, as a WebM file is a Matroska file. A cluster of unknown size, as live
  * recorders write, ends at the first element a cluster cannot hold.
  */
-export function stripWebm( content: Buffer ): Buffer | null {
+export function stripMatroska( content: Buffer, docType: 'webm' | 'matroska' ): Buffer | null {
 	const header = readElement( content, 0, content.length );
 	if ( ! header || header.id !== EBML_HEADER || header.end === null ) {
 		return null;
 	}
 	const headerChildren = readChildren( content, header );
-	const docType = headerChildren?.find( ( child ) => child.id === DOC_TYPE );
-	if ( ! docType || content.toString( 'latin1', docType.data, docType.end! ).replace( /\0+$/, '' ) !== WEBM_DOC_TYPE ) {
+	const docTypeElement = headerChildren?.find( ( child ) => child.id === DOC_TYPE );
+	if ( ! docTypeElement ) {
+		return null;
+	}
+	const found = content.toString( 'latin1', docTypeElement.data, docTypeElement.end! ).replace( /\0+$/, '' );
+	if ( found !== WEBM_DOC_TYPE && ! ( docType === 'matroska' && found === MATROSKA_DOC_TYPE ) ) {
 		return null;
 	}
 	const segment = readElement( content, header.end, content.length );
@@ -285,3 +291,108 @@ export function stripWebm( content: Buffer ): Buffer | null {
 	}
 	return stripped;
 }
+
+const RIFF_HEADER_SIZE = 12;
+const RIFF_CHUNK_HEADER_SIZE = 8;
+const MAX_AVI_CHUNKS = 100_000;
+const MAX_AVI_DEPTH = 8;
+const AVI_FORM = 'AVI ';
+const AVI_EXTENSION_FORM = 'AVIX';
+const JUNK = 'JUNK';
+const LIST = 'LIST';
+/** Chunks that hold text, XMP or vendor data; the `INFO` list is handled apart because it is a list. */
+const AVI_METADATA_CHUNKS: ReadonlySet<string> = new Set( [ 'IDIT', 'ISMP', '_PMX', 'strd', 'strn' ] );
+
+interface AviState {
+	chunks: number;
+	hasHeader: boolean;
+	hasMovie: boolean;
+	blanks: Array<[ number, number ]>;
+}
+
+/** Whether `[start, end)` of `bytes` is already a `JUNK` chunk of zeros, so blanking it changes nothing. */
+function isBlankJunk( bytes: Buffer, start: number, end: number ): boolean {
+	return bytes.toString( 'latin1', start, start + 4 ) === JUNK && ! bytes.subarray( start + RIFF_CHUNK_HEADER_SIZE, end ).some( ( byte ) => byte !== 0 );
+}
+
+/**
+ * Walks the RIFF chunks tiling `[start, end)` and records the ones to blank. Returns false when a chunk runs
+ * past its parent, bytes are left over, or the limits on chunks and depth are exceeded.
+ */
+function walkAvi( bytes: Buffer, start: number, end: number, depth: number, parent: string, firstRiff: boolean, state: AviState ): boolean {
+	if ( depth > MAX_AVI_DEPTH ) {
+		return false;
+	}
+	let offset = start;
+	while ( offset < end ) {
+		if ( ++state.chunks > MAX_AVI_CHUNKS || offset + RIFF_CHUNK_HEADER_SIZE > end ) {
+			return false;
+		}
+		const type = bytes.toString( 'latin1', offset, offset + 4 );
+		const size = bytes.readUInt32LE( offset + 4 );
+		const dataStart = offset + RIFF_CHUNK_HEADER_SIZE;
+		if ( size > end - dataStart ) {
+			return false;
+		}
+		const next = Math.min( dataStart + size + ( size & 1 ), end );
+		if ( type === LIST ) {
+			if ( size < 4 ) {
+				return false;
+			}
+			const listType = bytes.toString( 'latin1', dataStart, dataStart + 4 );
+			if ( listType === 'INFO' ) {
+				state.blanks.push( [ offset, next ] );
+			} else if ( listType === 'movi' ) {
+				state.hasMovie ||= firstRiff;
+			} else if ( ! walkAvi( bytes, dataStart + 4, dataStart + size, depth + 1, listType, firstRiff, state ) ) {
+				return false;
+			}
+		} else if ( AVI_METADATA_CHUNKS.has( type ) || type === JUNK ) {
+			state.blanks.push( [ offset, next ] );
+		} else if ( type === 'avih' && parent === 'hdrl' ) {
+			state.hasHeader ||= firstRiff;
+		}
+		offset = next;
+	}
+	return true;
+}
+
+/**
+ * The AVI with its `INFO` lists and its `IDIT`, `ISMP`, `_PMX` (XMP), `strd` (vendor data) and `strn`
+ * chunks, and the contents of `JUNK` chunks, overwritten by zeroed `JUNK` chunks of the same size, the input
+ * itself when there was nothing to remove, or null when the chunks do not read, the first RIFF lacks `hdrl`
+ * with `avih` or `movi`, or bytes follow the last RIFF. OpenDML `AVIX` RIFFs after the first are read the
+ * same way. No byte moves, so the `idx1` offsets stay valid; `movi` and `idx1` are never touched.
+ */
+export function stripAvi( content: Buffer ): Buffer | null {
+	const state: AviState = { chunks: 0, hasHeader: false, hasMovie: false, blanks: [] };
+	let offset = 0;
+	for ( let riffs = 0; offset < content.length; riffs++ ) {
+		if ( offset + RIFF_HEADER_SIZE > content.length || content.toString( 'latin1', offset, offset + 4 ) !== 'RIFF' ) {
+			return null;
+		}
+		const form = content.toString( 'latin1', offset + 8, offset + 12 );
+		if ( form !== ( riffs === 0 ? AVI_FORM : AVI_EXTENSION_FORM ) ) {
+			return null;
+		}
+		const size = content.readUInt32LE( offset + 4 );
+		const end = offset + RIFF_CHUNK_HEADER_SIZE + size;
+		if ( size < 4 || end > content.length || ! walkAvi( content, offset + RIFF_HEADER_SIZE, end, 0, form, riffs === 0, state ) ) {
+			return null;
+		}
+		offset = Math.min( end + ( size & 1 ), content.length );
+	}
+	if ( ! state.hasHeader || ! state.hasMovie ) {
+		return null;
+	}
+	const changes = state.blanks.filter( ( [ start, end ] ) => ! isBlankJunk( content, start, end ) );
+	if ( changes.length === 0 ) {
+		return content;
+	}
+	const stripped = Buffer.from( content );
+	for ( const [ start, end ] of changes ) {
+		stripped.write( JUNK, start, 'latin1' );
+		stripped.fill( 0, start + RIFF_CHUNK_HEADER_SIZE, end );
+	}
+	return stripped;
+}