H1K0 3b79f12ec0 fix(backend): bound image decode and ffmpeg during thumbnailing ...

Thumbnail/preview generation decoded untrusted images with no size limit
(a decompression bomb could exhaust memory) and ran ffmpeg with no
timeout (a malformed video could hang the request). Image dimensions are
now checked via image.DecodeConfig before the raster is allocated and
rejected above 64 Mpx, and ffmpeg runs under a 30s timeout.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-10 14:11:31 +03:00

..

config

fix(backend): cap upload size to prevent memory exhaustion

2026-06-10 14:07:34 +03:00

db

fix(backend): make access tokens revocable via session validation

2026-06-10 14:09:25 +03:00

domain

feat(backend): implement auth handler, middleware, and router

2026-04-04 00:43:41 +03:00

handler

fix(backend): make access tokens revocable via session validation

2026-06-10 14:09:25 +03:00

integration

fix(backend): make access tokens revocable via session validation

2026-06-10 14:09:25 +03:00

port

fix(backend): make access tokens revocable via session validation

2026-06-10 14:09:25 +03:00

service

fix(backend): make access tokens revocable via session validation

2026-06-10 14:09:25 +03:00

storage

fix(backend): bound image decode and ffmpeg during thumbnailing

2026-06-10 14:11:31 +03:00