fix(upload): enforce strict mp4 validation

Author: aiirvizionz

app/api/upload/route.ts

@@ -4,7 +4,7 @@ import path from "node:path";
 import { readSession, authConfigured, SESSION_COOKIE } from "@/lib/session";
 import { findOrCreateAccountByEmail, ownsParkedDomain, getTenantConfig, upsertTenant } from "@/lib/db";
 import { safeDomain } from "@/lib/config";
-import { ffmpegPoster } from "@/lib/media";
+import { ffmpegPoster, mediaTypeForUpload } from "@/lib/media";
 
 export const runtime = "nodejs";
 export const dynamic = "force-dynamic";
@@ -36,7 +36,7 @@ export async function POST(req: NextRequest) {
   try { form = await req.formData(); } catch { return NextResponse.json({ error: "Bad upload." }, { status: 400 }); }
   const file = form.get("file");
   if (!(file instanceof File)) return NextResponse.json({ error: "No file." }, { status: 400 });
-  const isMp4 = /\.mp4$/i.test(file.name) || /video\/mp4|application\/octet-stream/.test(file.type);
+  const isMp4 = mediaTypeForUpload(file.name, file.type) === "video/mp4";
   if (!isMp4) return NextResponse.json({ error: "MP4 files only." }, { status: 400 });
   if (file.size > MAX_BYTES) return NextResponse.json({ error: "Too big — 100 MB max." }, { status: 413 });
 

tests/media-upload-type.test.mjs

@@ -20,3 +20,9 @@ test("media upload type rejects empty or generic non-video names", () => {
   assert.equal(mediaTypeForUpload("payload", "application/octet-stream"), null);
   assert.equal(mediaTypeForUpload("clip.gif", "application/octet-stream"), null);
 });
+
+test("media upload type rejects substring MIME matches", () => {
+  assert.equal(mediaTypeForUpload("payload.bin", "application/octet-stream-extra"), null);
+  assert.equal(mediaTypeForUpload("payload.bin", "text/video/mp4"), null);
+  assert.equal(mediaTypeForUpload("payload.bin", "application/json; video/mp4"), null);
+});