feat(upload): reject mp4 uploads missing the moov atom

apps/backend/src/public-api/routes/v1/public.integrations.controller.ts

@@ -15,6 +15,8 @@ import {
 import {
   CustomFileValidationPipe,
   getMaxSize,
+  isCompleteMp4,
+  INCOMPLETE_MP4_ERROR,
 } from '@gitroom/nestjs-libraries/upload/custom.upload.validation';
 import { ApiTags } from '@nestjs/swagger';
 import { GetOrgFromRequest } from '@gitroom/nestjs-libraries/user/org.from.request';
@@ -138,6 +140,10 @@ export class PublicIntegrationsController {
       throw new HttpException({ msg: 'File is too large.' }, 400);
     }
 
+    if (detected.mime === 'video/mp4' && !isCompleteMp4(buffer)) {
+      throw new HttpException({ msg: INCOMPLETE_MP4_ERROR }, 400);
+    }
+
     const mimetype = detected.mime;
     const ext = detected.ext;
 

libraries/nestjs-libraries/src/chat/tools/upload.from.url.tool.ts

@@ -4,7 +4,11 @@ import { z } from 'zod';
 import { Injectable } from '@nestjs/common';
 import { MediaService } from '@gitroom/nestjs-libraries/database/prisma/media/media.service';
 import { UploadFactory } from '@gitroom/nestjs-libraries/upload/upload.factory';
-import { getMaxSize } from '@gitroom/nestjs-libraries/upload/custom.upload.validation';
+import {
+  getMaxSize,
+  isCompleteMp4,
+  INCOMPLETE_MP4_ERROR,
+} from '@gitroom/nestjs-libraries/upload/custom.upload.validation';
 import { checkAuth } from '@gitroom/nestjs-libraries/chat/auth.context';
 import { ssrfSafeDispatcher } from '@gitroom/nestjs-libraries/dtos/webhooks/ssrf.safe.dispatcher';
 import { Readable } from 'stream';
@@ -102,6 +106,10 @@ so the attachment passes the upload-domain validation. Returns the hosted media
             };
           }
 
+          if (detected.mime === 'video/mp4' && !isCompleteMp4(buffer)) {
+            return { error: INCOMPLETE_MP4_ERROR };
+          }
+
           const getFile = await this.storage.uploadFile({
             buffer,
             mimetype: detected.mime,

libraries/nestjs-libraries/src/upload/custom.upload.validation.ts

@@ -45,6 +45,10 @@ export class CustomFileValidationPipe implements PipeTransform {
       );
     }
 
+    if (detected.mime === 'video/mp4' && !isCompleteMp4(value.buffer)) {
+      throw new BadRequestException(INCOMPLETE_MP4_ERROR);
+    }
+
     value.mimetype = detected.mime;
     const safeBase = (value.originalname || 'upload')
       .replace(/\.[^./\\]*$/, '')
@@ -57,6 +61,47 @@ export class CustomFileValidationPipe implements PipeTransform {
 
 }
 
+export const INCOMPLETE_MP4_ERROR =
+  'Video file is corrupted or incomplete (missing moov atom). This usually means the file was uploaded before the encoder finished writing it — wait for the render to complete and upload it again.';
+
+// A playable mp4 must contain a top-level moov box (the index of the file).
+// Encoders write it last (or rewrite the file with it first for faststart),
+// so a file grabbed mid-encode has only ftyp + mdat and can't be played or
+// published anywhere.
+export function isCompleteMp4(buffer: Buffer): boolean {
+  let offset = 0;
+  while (offset + 8 <= buffer.length) {
+    let size: number = buffer.readUInt32BE(offset);
+    const type = buffer.toString('latin1', offset + 4, offset + 8);
+    if (type === 'moov') {
+      return true;
+    }
+    if (size === 0) {
+      // box extends to end of file
+      return false;
+    }
+    if (size === 1) {
+      if (offset + 16 > buffer.length) {
+        return false;
+      }
+      const largeSize = buffer.readBigUInt64BE(offset + 8);
+      if (largeSize > BigInt(Number.MAX_SAFE_INTEGER)) {
+        return false;
+      }
+      size = Number(largeSize);
+      // a largesize box header is 16 bytes, so smaller values are malformed
+      if (size < 16) {
+        return false;
+      }
+    }
+    if (size < 8) {
+      return false;
+    }
+    offset += size;
+  }
+  return false;
+}
+
 export function getMaxSize(mimeType: string): number {
   if (mimeType.startsWith('image/')) {
     return 10 * 1024 * 1024; // 10 MB