Don't inject untrusted input

[github/Chocobozzz/PeerTube.git] / shared / extra-utils / ffprobe.ts

diff --git a/shared/extra-utils/ffprobe.ts b/shared/extra-utils/ffprobe.ts
index dfacd251c6f84df5e60c87297603ae56bee06354..7efc58a0d944950e5c8c6ae7287d4a62ceb0af7d 100644 (file)
--- a/shared/extra-utils/ffprobe.ts
+++ b/shared/extra-utils/ffprobe.ts
@@ -1,5 +1,6 @@
 import { ffprobe, FfprobeData } from 'fluent-ffmpeg'
-import { VideoFileMetadata } from '@shared/models/videos'
+import { forceNumber } from '@shared/core-utils'
+import { VideoFileMetadata, VideoResolution } from '@shared/models/videos'
 
 /**
  *
@@ -21,10 +22,19 @@ function ffprobePromise (path: string) {
 // Audio
 // ---------------------------------------------------------------------------
 
+const imageCodecs = new Set([
+  'ansi', 'apng', 'bintext', 'bmp', 'brender_pix', 'dpx', 'exr', 'fits', 'gem', 'gif', 'jpeg2000', 'jpgls', 'mjpeg', 'mjpegb', 'msp2',
+  'pam', 'pbm', 'pcx', 'pfm', 'pgm', 'pgmyuv', 'pgx', 'photocd', 'pictor', 'png', 'ppm', 'psd', 'sgi', 'sunrast', 'svg', 'targa', 'tiff',
+  'txd', 'webp', 'xbin', 'xbm', 'xface', 'xpm', 'xwd'
+])
+
 async function isAudioFile (path: string, existingProbe?: FfprobeData) {
   const videoStream = await getVideoStream(path, existingProbe)
+  if (!videoStream) return true
+
+  if (imageCodecs.has(videoStream.codec_name)) return true
 
-  return !videoStream
+  return false
 }
 
 async function hasAudioStream (path: string, existingProbe?: FfprobeData) {
@@ -46,7 +56,7 @@ async function getAudioStream (videoPath: string, existingProbe?: FfprobeData) {
       return {
         absolutePath: data.format.filename,
         audioStream,
-        bitrate: parseInt(audioStream['bit_rate'] + '', 10)
+        bitrate: forceNumber(audioStream['bit_rate'])
       }
     }
   }
@@ -94,7 +104,15 @@ function getMaxAudioBitrate (type: 'aac' | 'mp3' | string, bitrate: number) {
 
 async function getVideoStreamDimensionsInfo (path: string, existingProbe?: FfprobeData) {
   const videoStream = await getVideoStream(path, existingProbe)
-  if (!videoStream) return undefined
+  if (!videoStream) {
+    return {
+      width: 0,
+      height: 0,
+      ratio: 0,
+      resolution: VideoResolution.H_NOVIDEO,
+      isPortraitMode: false
+    }
+  }
 
   return {
     width: videoStream.width,