Refuse non-media streams and gate video framing

2026-09-16 14:04:57 +02:00
parent c100bc269c
commit d522681553
5 changed files with 28 additions and 6 deletions
@@ -807,6 +807,13 @@ export function startWebUi(deps: WebUiDeps): WebUiHandle {
                throw new HttpError(502, `upstream ${upstream.status}`);
            }

+            // Never pipe a page into a media element: embed URLs that are not direct files
+            // (YouTube, provider redirectors) answer with HTML.
+            const upstreamType = upstream.headers.get("content-type") ?? "";
+            if (!/^(image|video|audio|application\/octet-stream)/i.test(upstreamType)) {
+                throw new HttpError(415, `not a media resource (${upstreamType || "unknown"})`);
+            }
+
            res.status(upstream.status);
            for (const header of ["content-type", "content-length", "accept-ranges", "content-range"]) {
                const value = upstream.headers.get(header);