From be81a953f38451ebb3bfbba5003f2b933422ac91 Mon Sep 17 00:00:00 2001
From: Nawid3333 <102778966+Nawid3333@users.noreply.github.com>
Date: Wed, 28 Oct 2026 21:15:16 +0100
Subject: [PATCH 1/3] A file is what its bytes are; Firefox's own player keeps
 the page's headers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A hoster served a Matroska file as video/mp4 from an .mp4 URL. The page's own <video>
played it; FastStream took it for an MP4 by its type, mp4box stopped at the first bytes
("Invalid data found while parsing box of type '£B'"), and the player failed.

- MP4Player looks at the first range's first 8 bytes (ContainerSniff.startsLikeMp4: a
  box's size, then four printable characters) and hands a file that cannot be an MP4 to
  Firefox's own player (playDirectly), which reads files by their bytes.
- That server sends a request without the page's Referer to a decoy. DirectVideoPlayer set
  its header rule once, and rules lived 5 s: the element's first request after that (the
  Matroska index at the end, a seek) had no Referer, and the source was reloaded. Its rule
  now lives 30 s and is renewed every 10 s while it has the source (SET_HEADERS'
  lifetimeMs, capped at 60 s). A request's rule stays 5 s.

mislabelled-file.e2e.mjs fails on main (the mp4box error) and with the hand-over alone
(the request 12 s in had no Referer); it passes with both.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 chrome/background/NetRequestRuleManager.mjs  |  24 ++-
 chrome/background/background.mjs             |   4 +-
 chrome/player/players/DirectVideoPlayer.mjs  |  30 ++-
 chrome/player/players/mp4/MP4Player.mjs      |  12 +-
 chrome/player/utils/ContainerSniff.mjs       |  30 +++
 docs/notes/player.md                         |  36 ++++
 tests/e2e/ext-specs/mislabelled-file.e2e.mjs | 188 +++++++++++++++++++
 tests/unit/ContainerSniff.test.mjs           |  51 +++++
 tests/unit/DirectVideoPlayer.test.mjs        |  59 +++++-
 tests/unit/NetRequestRuleManager.test.mjs    |  62 ++++++
 tests/unit/typeChecked.test.mjs              |   1 +
 types/messages.d.ts                          |   5 +
 12 files changed, 487 insertions(+), 15 deletions(-)
 create mode 100644 chrome/player/utils/ContainerSniff.mjs
 create mode 100644 tests/e2e/ext-specs/mislabelled-file.e2e.mjs
 create mode 100644 tests/unit/ContainerSniff.test.mjs

diff --git a/chrome/background/NetRequestRuleManager.mjs b/chrome/background/NetRequestRuleManager.mjs
index 6bbbf41f3..7d994f840 100644
--- a/chrome/background/NetRequestRuleManager.mjs
+++ b/chrome/background/NetRequestRuleManager.mjs
@@ -22,11 +22,22 @@ function extensionHost() {
   return new URL(chrome.runtime.getURL('/')).hostname;
 }
 
+// How long a header rule lives: a request's (FetchLoader's, for each one) goes out at once.
+export const RULE_LIFETIME_MS = 5000;
+// The most a rule may ask for: Firefox's own player (DirectVideoPlayer) makes its requests
+// whenever it needs them, and renews its rule while it has the source.
+export const MAX_RULE_LIFETIME_MS = 60000;
+
 export class RuleEntry {
-  /** @param {number} id - The session rule's id. */
-  constructor(id) {
+  /**
+   * @param {number} id - The session rule's id.
+   * @param {number} [lifetimeMs] - How long it lives: RULE_LIFETIME_MS, up to
+   *     MAX_RULE_LIFETIME_MS.
+   */
+  constructor(id, lifetimeMs) {
     this.id = id;
-    this.expiresAt = Date.now() + 1000 * 5;
+    const lifetime = Number.isFinite(lifetimeMs) ? /** @type {number} */ (lifetimeMs) : RULE_LIFETIME_MS;
+    this.expiresAt = Date.now() + Math.min(Math.max(lifetime, RULE_LIFETIME_MS), MAX_RULE_LIFETIME_MS);
   }
 }
 
@@ -120,10 +131,11 @@ export class RuleManager {
    * @param {string} url - The request URL the rule applies to.
    * @param {number} tabId - The tab whose requests it changes; TAB_ID_NONE for the extension's own.
    * @param {FSHeaderCommand[]} requestHeaderCommands - The headers to set or remove.
+   * @param {number} [lifetimeMs] - How long the rule lives (RuleEntry).
    */
-  async addHeaderRule(url, tabId, requestHeaderCommands) {
+  async addHeaderRule(url, tabId, requestHeaderCommands, lifetimeMs) {
     await this.initialClear;
-    const rule = new RuleEntry(this.getNextID());
+    const rule = new RuleEntry(this.getNextID(), lifetimeMs);
     // insert rule in order
     const index = this.getInsertionIndex(rule.id);
     if (index === -1) throw new Error('Rule already exists');
@@ -143,7 +155,7 @@ export class RuleManager {
         // a `*` made the rule demand a backslash no URL has, and a stream URL
         // like an Akamai `acl=/*` token got no Referer/Origin. Unescaped, a
         // `*`, `^` or `|` from the URL can only widen the match, never exclude
-        // the URL itself, and the rule is limited to one tab and 5 seconds.
+        // the URL itself, and the rule is limited to one tab and its lifetime.
         // Only the scheme at the start: an http URL whose query holds an https one
         // lost that "https://" instead. A `|` at its very end anchors the end there,
         // before that `|`, and the URL itself did not match: a `*` after it keeps it
diff --git a/chrome/background/background.mjs b/chrome/background/background.mjs
index b3fdc58fb..21003d3ba 100644
--- a/chrome/background/background.mjs
+++ b/chrome/background/background.mjs
@@ -1270,8 +1270,8 @@ chrome.runtime.onMessage.addListener((msg, sender, sendResponse) => {
       return;
     }
     if (msg.commands.length) {
-      // A tab that sends a message has an id.
-      ruleManager.addHeaderRule(msg.url, /** @type {number} */ (senderTab.id), msg.commands).then((rule) => {
+      // A tab that sends a message has an id. The rule's lifetime is capped (RuleEntry).
+      ruleManager.addHeaderRule(msg.url, /** @type {number} */ (senderTab.id), msg.commands, msg.lifetimeMs).then((rule) => {
         if (Logging) console.log('Added rule', msg, rule);
         sendResponse();
       }).catch((e) => {
diff --git a/chrome/player/players/DirectVideoPlayer.mjs b/chrome/player/players/DirectVideoPlayer.mjs
index 0de2a07a8..d99e43ce0 100644
--- a/chrome/player/players/DirectVideoPlayer.mjs
+++ b/chrome/player/players/DirectVideoPlayer.mjs
@@ -31,6 +31,14 @@ export function elementHeaderCommands(headers) {
   return commands;
 }
 
+// How long the background keeps the element's header rule, and how often the player renews
+// it while it has the source. Firefox's player asks for ranges when it needs them: on a
+// seek, after a long pause, for a Matroska file's index at its end. A request's rule lives
+// 5 s, and those went out without the page's Referer or cookie: a hoster's server answered
+// the first one after 5 s with a redirect to a decoy, and the source was reloaded.
+export const HEADER_RULE_LIFETIME_MS = 30000;
+export const HEADER_RULE_RENEW_MS = 10000;
+
 // What a direct video can be saved as. A URL without an extension (".../watch?v=1") was saved
 // as .webm, and one ending in .php as .php: most direct videos are MP4.
 const MEDIA_EXTENSIONS = new Set(['mp4', 'm4v', 'mov', 'webm', 'mkv', 'ogv', 'ogg', 'mp3', 'm4a', 'aac', 'wav', 'flac', 'opus', 'weba', 'oga']);
@@ -57,6 +65,8 @@ export default class DirectVideoPlayer extends EventEmitter {
     this.client = client;
 
     this.video = /** @type {HTMLVideoElement} */ (document.createElement(config?.isAudioOnly ? 'audio' : 'video'));
+    /** @type {?ReturnType<typeof setInterval>} */
+    this.headerRenewal = null;
   }
 
   load() {
@@ -82,6 +92,7 @@ export default class DirectVideoPlayer extends EventEmitter {
   /** @param {import('../VideoSource.mjs').VideoSource} source */
   async setSource(source) {
     this.source = source;
+    this.stopHeaderRenewal();
     const url = URLUtils.playableUrl(source.url, document.baseURI);
     if (!url) {
       // As the media element reports a source it cannot load: an ERROR after this call,
@@ -92,25 +103,35 @@ export default class DirectVideoPlayer extends EventEmitter {
     // Firefox's own loader sends the page's headers only if the background's rule for this URL
     // sets them (the rule the MP4 player's requests get through FetchLoader): the Referer or
     // cookie a site asks for, so a source handed over from the MP4 player (playDirectly) plays.
-    await this.setHeaderRule(source, url);
+    // Renewed while this is the source: the element's later requests need it as much.
+    if (await this.setHeaderRule(source, url) && this.source === source && this.video) {
+      this.headerRenewal = setInterval(() => this.setHeaderRule(source, url), HEADER_RULE_RENEW_MS);
+    }
     this.video.src = url;
   }
 
+  stopHeaderRenewal() {
+    if (this.headerRenewal !== null) clearInterval(this.headerRenewal);
+    this.headerRenewal = null;
+  }
+
   /**
    * Asks the background to set the source's headers on the requests for its URL.
    * @param {?import('../VideoSource.mjs').VideoSource} source
    * @param {string} url - The URL the element loads.
+   * @return {Promise<boolean>} Whether the source has headers to set.
    */
   async setHeaderRule(source, url) {
-    if (!EnvUtils.isExtension() || !/^https?:/i.test(url)) return;
+    if (!EnvUtils.isExtension() || !/^https?:/i.test(url)) return false;
     const commands = elementHeaderCommands(source?.headers);
-    if (!commands.length) return;
+    if (!commands.length) return false;
     try {
-      await chrome.runtime.sendMessage({type: MessageTypes.SET_HEADERS, url, commands});
+      await chrome.runtime.sendMessage({type: MessageTypes.SET_HEADERS, url, commands, lifetimeMs: HEADER_RULE_LIFETIME_MS});
     } catch (e) {
       // Without the rule it plays as it did before: without the headers.
       console.warn('Could not set the headers of the source', e);
     }
+    return true;
   }
 
   getSource() {
@@ -130,6 +151,7 @@ export default class DirectVideoPlayer extends EventEmitter {
   }
 
   destroy() {
+    this.stopHeaderRenewal();
     VideoUtils.destroyVideo(this.video);
     this.video = /** @type {any} */ (null);
 
diff --git a/chrome/player/players/mp4/MP4Player.mjs b/chrome/player/players/mp4/MP4Player.mjs
index 3aa60957c..1b686d420 100644
--- a/chrome/player/players/mp4/MP4Player.mjs
+++ b/chrome/player/players/mp4/MP4Player.mjs
@@ -4,6 +4,7 @@ import {DownloadStatus} from '../../enums/DownloadStatus.mjs';
 import {ReferenceTypes} from '../../enums/ReferenceTypes.mjs';
 import {EmitterCancel, EmitterRelay, EventEmitter} from '../../modules/eventemitter.mjs';
 import {createFile} from '../../modules/mp4box/mp4box.all.mjs';
+import {startsLikeMp4} from '../../utils/ContainerSniff.mjs';
 import {Utils} from '../../utils/Utils.mjs';
 import {VideoUtils} from '../../utils/VideoUtils.mjs';
 import {AudioLevel, VideoLevel} from '../Levels.mjs';
@@ -704,6 +705,14 @@ export default class MP4Player extends EventEmitter {
               return;
             }
 
+            // Not an MP4 at all, whatever its server and URL call it (a Matroska file served
+            // as video/mp4): mp4box reads only MP4's boxes, Firefox's own player reads it.
+            if (frag.rangeStart === 0 && !this.metaData && data?.byteLength &&
+                !startsLikeMp4(new Uint8Array(data, 0, Math.min(data.byteLength, 8)))) {
+              this.playDirectly('The file is not an MP4 file');
+              return;
+            }
+
             const hadMetaData = !!this.metaData;
             this.mp4box.appendBuffer(data);
             this.refreshSampleIndex();
@@ -921,7 +930,8 @@ export default class MP4Player extends EventEmitter {
 
   /**
    * Hands the source to Firefox's own player (DirectVideoPlayer), for a server this player
-   * cannot load in ranges (RangeAnswers.mjs). Once: this player stops loading.
+   * cannot load in ranges (RangeAnswers.mjs) or a file that is no MP4 (ContainerSniff.mjs).
+   * Once: this player stops loading.
    * @param {string} reason
    */
   playDirectly(reason) {
diff --git a/chrome/player/utils/ContainerSniff.mjs b/chrome/player/utils/ContainerSniff.mjs
new file mode 100644
index 000000000..cce1f0b4c
--- /dev/null
+++ b/chrome/player/utils/ContainerSniff.mjs
@@ -0,0 +1,30 @@
+// @ts-check
+
+// Whether a file's first bytes can be an MP4's (ISO BMFF, QuickTime), the only files
+// MP4Player's mp4box reads. A server and a URL can call a file video/mp4 and .mp4 when it
+// is not one: a hoster's Matroska file came as both, mp4box stopped at its first bytes
+// ("Invalid data found while parsing box of type '£B'"), and the player failed on a file
+// the page's own <video> played. Firefox's own player goes by what the bytes are, so
+// MP4Player hands it a file that is no MP4 (playDirectly).
+//
+// An MP4 is a row of boxes. Each starts with its size, 32 bits (0: to the file's end; 1: a
+// 64-bit size follows the type; else at least the box head's 8 bytes), then its type: four
+// printable characters ("ftyp", "moov", "mdat", "free", "wide", "pnot"...). The start of
+// every other format breaks that: Matroska's and WebM's EBML magic 1A 45 DF A3 is followed
+// by bytes no type has, and so are Ogg's "OggS", FLAC's "fLaC", MP3's ID3 tag, WAV's RIFF
+// size, FLV's flags and MPEG-TS's packet header.
+
+/**
+ * @param {Uint8Array} bytes - The file's first bytes.
+ * @return {boolean} False when they cannot be the start of an MP4's first box; true when
+ *     they can, or when fewer than its 8 bytes tell nothing.
+ */
+export function startsLikeMp4(bytes) {
+  if (bytes.length < 8) return true;
+  const size = new DataView(bytes.buffer, bytes.byteOffset, 8).getUint32(0);
+  if (size !== 0 && size !== 1 && size < 8) return false;
+  for (let i = 4; i < 8; i++) {
+    if (bytes[i] < 0x20 || bytes[i] > 0x7E) return false;
+  }
+  return true;
+}
diff --git a/docs/notes/player.md b/docs/notes/player.md
index b92cfd6ce..d3c8d62de 100644
--- a/docs/notes/player.md
+++ b/docs/notes/player.md
@@ -163,6 +163,42 @@ played a minute in, and one padded to whole ranges that must fire `ended` with n
 the one after its end (without `endsAt`: 11 ranges past the end and no end, or 6 retries of the
 416 and the load error).
 
+## A file is what its bytes are, and Firefox's own player keeps the page's headers (2026-10-28)
+
+A hoster served a Matroska file (H.264, AAC, SRT; written by mkvmerge) as `video/mp4`, from a
+URL ending in `.mp4`, beside an MP4 of the same video on another link. Measured on the installed
+extension with a local copy of that shape:
+
+- **The page's own `<video>` played it, FastStream's player failed.** The type and the URL
+  picked `ACCELERATED_MP4`, mp4box stopped at the first bytes ("Invalid data found while
+  parsing box of type '£B' at position 0"), and the player showed the load error. Firefox's
+  element reads a file by its bytes: served as `video/mp4`, `application/octet-stream` or
+  `video/x-matroska`, it played the Matroska file every time. `MP4Player` now looks at the
+  first range's first 8 bytes (`ContainerSniff.startsLikeMp4`: a box's size, then four
+  printable characters) and hands a file that cannot be an MP4 to Firefox's own player
+  (`playDirectly`), one range in. Every real MP4 and QuickTime file starts with a box, so none
+  leaves MP4Player; HTML that happens to start like one fails in mp4box, as before.
+- **Firefox's own player lost the page's headers after 5 s.** That server answered a request
+  without the page's Referer with a 302 to a decoy. `DirectVideoPlayer` set its header rule
+  once, and every rule lived 5 s (`RuleEntry`): the element's first request after that (the
+  Matroska index at the file's end, read 12 s in, or a seek) went out with no Referer, to the
+  decoy, and the client's recovery reloaded the source (the buffer fell from 39 s to 9 s). The
+  element's rule now lives 30 s and is renewed every 10 s while the player has the source
+  (`SET_HEADERS`' `lifetimeMs`, capped at 60 s); a request's rule stays 5 s. After the player
+  is gone the rule lasts at most 30 s, limited to the extension's own requests in that tab.
+
+The background's 64 KB read of the file (`StreamLengths`) sees the same bytes and could pick
+the player before MP4Player tries; not done yet: the hand-over costs one range.
+
+`mislabelled-file.e2e.mjs`: a Matroska film served as `video/mp4` from an `.mp4` URL by a server
+that sends a request without the page's Referer to a decoy, at 400 KB/s; the player plays it in
+Firefox's own player, plays on after a seek 12 s in, and no request lacks the Referer. On main it
+failed with the mp4box error; with the hand-over alone, the request 12 s in had no Referer.
+
+The e2e web build (`wdio.conf.mjs`) serves the player with COOP/COEP: Firefox's own player there
+loads only files whose server sends `Cross-Origin-Resource-Policy`, which every spec's server
+does. The extension's player page is not cross-origin isolated: measure DIRECT there.
+
 ## AAC in a channel layout of its own, on Windows (2026-10-12)
 
 Reported on a film site (its hoster: one MP4 per quality, `[360p]url,...`
diff --git a/tests/e2e/ext-specs/mislabelled-file.e2e.mjs b/tests/e2e/ext-specs/mislabelled-file.e2e.mjs
new file mode 100644
index 000000000..998b47c86
--- /dev/null
+++ b/tests/e2e/ext-specs/mislabelled-file.e2e.mjs
@@ -0,0 +1,188 @@
+// A file is what its bytes are, not what its server calls it.
+//
+// A hoster served a Matroska file as video/mp4, from a URL ending in .mp4. The page's own
+// <video> played it: Firefox's player reads a file by its bytes. FastStream took it for an
+// MP4 by its type, its MP4 player's mp4box stopped at the first bytes ("Invalid data found
+// while parsing box of type '£B'"), and the player failed where the page's had played. The
+// MP4 player now hands a file that is no MP4 to Firefox's own player (playDirectly).
+//
+// That server answered a request without the page's Referer with a redirect to a decoy.
+// Firefox's own player in FastStream got the page's headers from a rule the background set
+// for 5 s, and asks for ranges whenever it needs them: the first request after those 5 s
+// (a Matroska file's index at its end, a seek) went to the decoy, and the source was
+// reloaded. Its rule now lives 30 s and is renewed while it has the source.
+//
+// Driven on the installed extension, the site on the auto-enable list: the page plays the
+// film, the player takes it over, plays it, and plays on after a seek far ahead, 12 s in.
+
+import {spawnSync} from 'node:child_process';
+import fs from 'node:fs';
+import http from 'node:http';
+import os from 'node:os';
+import path from 'node:path';
+
+import {browser, expect} from '@wdio/globals';
+
+import {inExtensionPage} from '../extension-page.mjs';
+import {byteRange} from '../serveFile.mjs';
+
+const SITE_PORT = 41966;
+const DECOY_PORT = 41967;
+const SITE = `http://127.0.0.1:${SITE_PORT}`;
+const FIXTURES = path.resolve(import.meta.dirname, '../fixtures');
+// About 400 KB/s, four times the film's rate: a seek far ahead needs a request of its own.
+const BYTES_PER_TICK = 40 * 1024;
+
+let siteServer;
+let decoyServer;
+let workDir;
+let film;
+/** @type {Array<{at: number, range: string, referer: string}>} */
+const filmRequests = [];
+let decoyRequests = 0;
+
+describe('A Matroska file its server calls an MP4', function() {
+  before(async function() {
+    workDir = fs.mkdtempSync(path.join(os.tmpdir(), 'faststream-mislabelled-'));
+    const file = path.join(workDir, 'film.mkv');
+    // long-av.mp4's 160 s, as Matroska.
+    const {status, stderr} = spawnSync('ffmpeg', ['-y', '-v', 'error', '-i', path.join(FIXTURES, 'long-av.mp4'),
+      '-c', 'copy', '-f', 'matroska', file], {encoding: 'utf8'});
+    if (status !== 0) {
+      throw new Error(`could not remux the film fixture with ffmpeg: ${stderr}`);
+    }
+    film = fs.readFileSync(file);
+
+    siteServer = http.createServer((req, res) => {
+      const url = new URL(req.url, SITE);
+      if (url.pathname === '/watch') {
+        res.writeHead(200, {'Content-Type': 'text/html'});
+        res.end('<!doctype html><body style="margin:0"><video muted autoplay controls width="640" height="360" src="/media/film.mp4"></video></body>');
+        return;
+      }
+      if (url.pathname !== '/media/film.mp4') {
+        res.writeHead(404);
+        res.end();
+        return;
+      }
+      const referer = req.headers.referer || '';
+      filmRequests.push({at: Date.now(), range: req.headers.range || '-', referer});
+      if (!referer.startsWith(SITE + '/')) {
+        res.writeHead(302, {Location: `http://127.0.0.1:${DECOY_PORT}/decoy.mp4`});
+        res.end();
+        return;
+      }
+      const range = byteRange(req.headers.range, film.length);
+      if (range === 'unsatisfiable') {
+        res.writeHead(416, {'Content-Range': `bytes */${film.length}`});
+        res.end();
+        return;
+      }
+      const head = {'Content-Type': 'video/mp4', 'Accept-Ranges': 'bytes'};
+      let start = 0;
+      let end = film.length - 1;
+      if (range) {
+        ({start, end} = range);
+        res.writeHead(206, {...head, 'Content-Range': `bytes ${start}-${end}/${film.length}`, 'Content-Length': end - start + 1});
+      } else {
+        res.writeHead(200, {...head, 'Content-Length': film.length});
+      }
+      let at = start;
+      const timer = setInterval(() => {
+        if (at > end) {
+          clearInterval(timer);
+          res.end();
+          return;
+        }
+        const next = Math.min(end + 1, at + BYTES_PER_TICK);
+        res.write(film.subarray(at, next));
+        at = next;
+      }, 100);
+      res.on('close', () => clearInterval(timer));
+    });
+    decoyServer = http.createServer((req, res) => {
+      decoyRequests++;
+      res.writeHead(404);
+      res.end();
+    });
+    await new Promise((resolve) => siteServer.listen(SITE_PORT, '127.0.0.1', resolve));
+    await new Promise((resolve) => decoyServer.listen(DECOY_PORT, '127.0.0.1', resolve));
+
+    await inExtensionPage((site, done) => {
+      chrome.storage.local.set({options: JSON.stringify({autoEnableURLs: [site + '/']})}, () => {
+        chrome.runtime.sendMessage({type: 'LOAD_OPTIONS'}, () => {
+          void chrome.runtime.lastError;
+          setTimeout(() => done(true), 500);
+        });
+      });
+    }, SITE);
+  });
+
+  after(async function() {
+    await browser.switchFrame(null);
+    for (const server of [siteServer, decoyServer]) {
+      if (!server) continue;
+      server.closeAllConnections();
+      await new Promise((resolve) => server.close(resolve));
+    }
+    if (workDir) fs.rmSync(workDir, {recursive: true, force: true});
+  });
+
+  it('plays it in Firefox\'s own player, with the page\'s Referer after a seek 12 s in', async function() {
+    await browser.url(`${SITE}/watch`);
+    await browser.waitUntil(async () => browser.execute(() => {
+      return Array.from(document.querySelectorAll('iframe')).some((f) => f.src.includes('player/index.html'));
+    }), {timeout: 30000, timeoutMsg: 'the in-page player never replaced the page\'s video'});
+    const opened = Date.now();
+    await browser.switchFrame(await browser.$('iframe[src*="player/index.html"]'));
+    const state = () => browser.execute(() => {
+      const client = window.fastStream;
+      const video = client?.player?.getVideo?.();
+      return {
+        mode: client?.source?.mode,
+        readyState: video ? video.readyState : null,
+        time: video ? video.currentTime : null,
+        failed: !!client?.interfaceController?.failed,
+      };
+    });
+    try {
+      let playing;
+      await browser.waitUntil(async () => {
+        playing = await state();
+        if (playing.failed) return true;
+        if (playing.readyState >= 2) return true;
+        await browser.execute(() => {
+          window.fastStream?.player?.getVideo?.()?.play().catch(() => {});
+          return true;
+        });
+        return false;
+      }, {timeout: 30000, interval: 500, timeoutMsg: 'the player never played the film'});
+      console.log('      playing:', JSON.stringify(playing));
+      expect(playing.failed).toBe(false);
+      expect(playing.mode).toBe('direct');
+
+      // Well past a request's 5 s rule, far past what is buffered.
+      await browser.pause(Math.max(0, 12000 - (Date.now() - opened)));
+      await browser.execute(() => {
+        window.fastStream.player.getVideo().currentTime = 130;
+        return true;
+      });
+      let after;
+      await browser.waitUntil(async () => {
+        after = await state();
+        return after.failed || (after.time > 131 && after.readyState >= 3);
+      }, {timeout: 30000, interval: 500, timeoutMsg: 'the player did not play on after the seek'}).catch(() => {});
+      console.log('      after the seek:', JSON.stringify(after));
+      expect(after.failed).toBe(false);
+      expect(after.time).toBeGreaterThan(131);
+    } finally {
+      await browser.switchFrame(null);
+      for (const r of filmRequests) {
+        console.log(`      request +${r.at - opened} ms ${r.range} referer ${r.referer ? 'page' : 'none'}`);
+      }
+    }
+    // Every one of the film's requests had the page's Referer: none went to the decoy.
+    expect(filmRequests.filter((r) => !r.referer)).toEqual([]);
+    expect(decoyRequests).toBe(0);
+  });
+});
diff --git a/tests/unit/ContainerSniff.test.mjs b/tests/unit/ContainerSniff.test.mjs
new file mode 100644
index 000000000..0a9b5b58a
--- /dev/null
+++ b/tests/unit/ContainerSniff.test.mjs
@@ -0,0 +1,51 @@
+import {describe, expect, it} from 'vitest';
+
+import {startsLikeMp4} from '../../chrome/player/utils/ContainerSniff.mjs';
+
+// A hoster's Matroska file came as video/mp4 from an .mp4 URL: MP4Player gave it to mp4box,
+// which stopped at its first bytes, and the player failed on a file the page's own <video>
+// played. MP4Player now hands a file that cannot be an MP4 to Firefox's own player.
+
+const bytes = (...parts) => new Uint8Array(parts.flatMap((part) => typeof part === 'string' ?
+  [...part].map((c) => c.charCodeAt(0)) : part));
+const size = (n) => [(n >>> 24) & 255, (n >>> 16) & 255, (n >>> 8) & 255, n & 255];
+
+describe('startsLikeMp4', () => {
+  it.each([
+    ['ftyp', bytes(size(32), 'ftypisom', [0, 0, 2, 0])],
+    ['a media segment\'s styp', bytes(size(24), 'stypmsdh')],
+    ['moov first', bytes(size(4096), 'moov', size(108), 'mvhd')],
+    ['mdat first, its size to the file\'s end', bytes(size(0), 'mdat')],
+    ['a 64-bit size', bytes(size(1), 'mdat', [0, 0, 0, 1, 0, 0, 0, 0])],
+    ['QuickTime\'s wide and free', bytes(size(8), 'wide'), bytes(size(8), 'free')],
+    ['QuickTime\'s preview', bytes(size(20), 'pnot')],
+  ])('takes %s for an MP4', (name, ...starts) => {
+    for (const start of starts) expect(startsLikeMp4(start)).toBe(true);
+  });
+
+  it.each([
+    ['Matroska', bytes([0x1A, 0x45, 0xDF, 0xA3, 0xA3, 0x42, 0x86, 0x81, 0x01])],
+    ['WebM', bytes([0x1A, 0x45, 0xDF, 0xA3, 0x9F, 0x42, 0x86, 0x81, 0x01])],
+    ['Ogg', bytes('OggS', [0, 2, 0, 0, 0, 0, 0, 0])],
+    ['FLAC', bytes('fLaC', [0, 0, 0, 0x22])],
+    ['MP3 with an ID3 tag', bytes('ID3', [4, 0, 0, 0, 0, 0x23, 0x76])],
+    ['WAV', bytes('RIFF', [0x24, 0xA3, 0x1B, 0x00], 'WAVE')],
+    ['FLV', bytes('FLV', [1, 5, 0, 0, 0, 9])],
+    ['MPEG-TS', bytes([0x47, 0x40, 0x00, 0x10, 0x00, 0x00, 0xB0, 0x0D])],
+    ['a box too short for its own head', bytes(size(4), 'ftyp')],
+  ])('does not take %s for an MP4', (name, start) => {
+    expect(startsLikeMp4(start)).toBe(false);
+  });
+
+  it('cannot tell from fewer than 8 bytes, and leaves those to mp4box', () => {
+    expect(startsLikeMp4(new Uint8Array(0))).toBe(true);
+    expect(startsLikeMp4(bytes([0x1A, 0x45, 0xDF, 0xA3]))).toBe(true);
+  });
+
+  it('reads the bytes where a view of a larger buffer starts', () => {
+    const buffer = bytes([0, 0, 0, 0], [0x1A, 0x45, 0xDF, 0xA3, 0xA3, 0x42, 0x86, 0x81]).buffer;
+    expect(startsLikeMp4(new Uint8Array(buffer, 4, 8))).toBe(false);
+    const mp4 = bytes([0x1A, 0x45, 0xDF, 0xA3], size(32), 'ftyp').buffer;
+    expect(startsLikeMp4(new Uint8Array(mp4, 4, 8))).toBe(true);
+  });
+});
diff --git a/tests/unit/DirectVideoPlayer.test.mjs b/tests/unit/DirectVideoPlayer.test.mjs
index f69acfe3c..b64387f53 100644
--- a/tests/unit/DirectVideoPlayer.test.mjs
+++ b/tests/unit/DirectVideoPlayer.test.mjs
@@ -1,6 +1,6 @@
-import {describe, expect, it} from 'vitest';
+import {afterEach, beforeEach, describe, expect, it, vi} from 'vitest';
 
-import {elementHeaderCommands, saveExtension} from '../../chrome/player/players/DirectVideoPlayer.mjs';
+import DirectVideoPlayer, {elementHeaderCommands, HEADER_RULE_LIFETIME_MS, HEADER_RULE_RENEW_MS, saveExtension} from '../../chrome/player/players/DirectVideoPlayer.mjs';
 
 // A source handed from the MP4 player to Firefox's own (playDirectly) keeps the page's
 // headers through the background's rule for its URL: the Referer or cookie a site asks for.
@@ -48,3 +48,58 @@ describe('saveExtension', () => {
     expect(saveExtension(null)).toBe('mp4');
   });
 });
+
+// Firefox's player asks for ranges whenever it needs them: on a seek, after a long pause, for
+// a Matroska file's index at its end. The rule set once lived 5 s, and the first request after
+// that went out without the page's Referer: a hoster's server sent it to a decoy, and the
+// source was reloaded. The rule now lives 30 s and is renewed while the player has the source.
+describe('DirectVideoPlayer\'s header rule', () => {
+  let sent;
+  let player;
+
+  beforeEach(() => {
+    vi.useFakeTimers();
+    sent = [];
+    const video = {src: '', pause() {}, removeAttribute() {}, load() {}};
+    globalThis.document = {createElement: () => video, baseURI: 'https://site.test/watch'};
+    globalThis.chrome = {extension: {}, runtime: {sendMessage: async (message) => {
+      sent.push(message);
+    }}};
+    player = new DirectVideoPlayer(/** @type {any} */ ({}));
+  });
+
+  afterEach(() => {
+    vi.useRealTimers();
+    delete globalThis.document;
+    delete globalThis.chrome;
+  });
+
+  const source = (headers) => /** @type {any} */ ({url: 'https://cdn.test/v/film', headers});
+
+  it('lives 30 s, and is renewed every 10 s while the player has the source', async () => {
+    await player.setSource(source({Referer: 'https://site.test/watch'}));
+    expect(sent).toEqual([{type: 'SET_HEADERS', url: 'https://cdn.test/v/film', lifetimeMs: HEADER_RULE_LIFETIME_MS,
+      commands: [{operation: 'set', header: 'Referer', value: 'https://site.test/watch'}]}]);
+    expect(HEADER_RULE_LIFETIME_MS).toBeGreaterThan(HEADER_RULE_RENEW_MS * 2);
+    await vi.advanceTimersByTimeAsync(HEADER_RULE_RENEW_MS * 3);
+    expect(sent).toHaveLength(4);
+    expect(new Set(sent.map((message) => JSON.stringify(message))).size).toBe(1);
+  });
+
+  it('is no longer renewed once the player is gone, or has another source', async () => {
+    await player.setSource(source({Referer: 'https://site.test/watch'}));
+    await player.setSource(source({Referer: 'https://site.test/other'}));
+    await vi.advanceTimersByTimeAsync(HEADER_RULE_RENEW_MS);
+    expect(sent.map((message) => message.commands[0].value)).toEqual(['https://site.test/watch', 'https://site.test/other', 'https://site.test/other']);
+    player.destroy();
+    await vi.advanceTimersByTimeAsync(HEADER_RULE_RENEW_MS * 3);
+    expect(sent).toHaveLength(3);
+  });
+
+  it('is neither set nor renewed for a source without headers', async () => {
+    await player.setSource(source({}));
+    await vi.advanceTimersByTimeAsync(HEADER_RULE_RENEW_MS * 3);
+    expect(sent).toEqual([]);
+    expect(player.headerRenewal).toBe(null);
+  });
+});
diff --git a/tests/unit/NetRequestRuleManager.test.mjs b/tests/unit/NetRequestRuleManager.test.mjs
index f5a066550..d1968bc47 100644
--- a/tests/unit/NetRequestRuleManager.test.mjs
+++ b/tests/unit/NetRequestRuleManager.test.mjs
@@ -235,3 +235,65 @@ describe('RuleManager, a rule added while the last event page\'s are cleared', (
     expect(calls.slice(0, 2)).toEqual(['clear', 'add']);
   });
 });
+
+// Firefox's own player (DirectVideoPlayer) asks for ranges whenever it needs them, long after
+// it set its rule: a request's 5 s were over by then, and a seek went out without the page's
+// Referer. It asks for a longer rule and renews it; a rule's lifetime stays capped.
+describe('RuleManager, a rule\'s lifetime', () => {
+  let held;
+
+  beforeEach(() => {
+    vi.useFakeTimers();
+    held = new Set();
+    globalThis.chrome = {
+      runtime: {getURL: (path) => 'moz-extension://test-uuid' + path},
+      declarativeNetRequest: {
+        getSessionRules: async () => [],
+        updateSessionRules: async (update) => {
+          for (const id of update.removeRuleIds || []) held.delete(id);
+          for (const rule of update.addRules || []) held.add(rule.id);
+        },
+      },
+    };
+  });
+
+  afterEach(() => {
+    vi.useRealTimers();
+    delete globalThis.chrome;
+  });
+
+  const referer = [{operation: 'set', header: 'referer', value: 'https://site.test/'}];
+
+  it('is 5 s for a request\'s rule', async () => {
+    const manager = new RuleManager();
+    const rule = await manager.addHeaderRule('https://cdn.test/a.mp4', 7, referer);
+    await vi.advanceTimersByTimeAsync(4000);
+    expect(held.has(rule.id)).toBe(true);
+    await vi.advanceTimersByTimeAsync(2500);
+    expect(held.has(rule.id)).toBe(false);
+  });
+
+  it('is as long as asked for, up to 60 s', async () => {
+    const manager = new RuleManager();
+    const element = await manager.addHeaderRule('https://cdn.test/a.mkv', 7, referer, 30000);
+    const greedy = await manager.addHeaderRule('https://cdn.test/b.mkv', 7, referer, 3600000);
+    await vi.advanceTimersByTimeAsync(29000);
+    expect(held.has(element.id)).toBe(true);
+    await vi.advanceTimersByTimeAsync(2500);
+    expect(held.has(element.id)).toBe(false);
+    expect(held.has(greedy.id)).toBe(true);
+    await vi.advanceTimersByTimeAsync(30000);
+    expect(held.has(greedy.id)).toBe(false);
+  });
+
+  it('is never shorter than a request\'s, nor made of something that is no number', async () => {
+    const manager = new RuleManager();
+    const short = await manager.addHeaderRule('https://cdn.test/a.mp4', 7, referer, 10);
+    const odd = await manager.addHeaderRule('https://cdn.test/b.mp4', 7, referer, /** @type {any} */ ('forever'));
+    await vi.advanceTimersByTimeAsync(4000);
+    expect(held.has(short.id)).toBe(true);
+    expect(held.has(odd.id)).toBe(true);
+    await vi.advanceTimersByTimeAsync(2500);
+    expect(held.size).toBe(0);
+  });
+});
diff --git a/tests/unit/typeChecked.test.mjs b/tests/unit/typeChecked.test.mjs
index 9c717c1ad..016fd7ae0 100644
--- a/tests/unit/typeChecked.test.mjs
+++ b/tests/unit/typeChecked.test.mjs
@@ -170,6 +170,7 @@ const CHECKED = [
   'chrome/player/utils/AudioUtils.mjs',
   'chrome/player/utils/BlobManager.mjs',
   'chrome/player/utils/BrokenMedia.mjs',
+  'chrome/player/utils/ContainerSniff.mjs',
   'chrome/player/utils/EnvUtils.mjs',
   'chrome/player/utils/FastStreamArchiveUtils.mjs',
   'chrome/player/utils/InterfaceUtils.mjs',
diff --git a/types/messages.d.ts b/types/messages.d.ts
index 0ea7a7aa7..9e204196a 100644
--- a/types/messages.d.ts
+++ b/types/messages.d.ts
@@ -95,6 +95,11 @@ interface FSSetHeaders extends FSMessageBase {
   /** Request URL the rules apply to. */
   url: string;
   commands: FSHeaderCommand[];
+  /**
+   * How long the rule lives, in ms: 5 s without it, at most 60 s (RuleEntry). Firefox's own
+   * player (DirectVideoPlayer) asks for longer and renews it while it has the source.
+   */
+  lifetimeMs?: number;
 }
 
 interface FSHeaderCommand {

From fd219492e8f6c18596dd5607184c7e908f7937e8 Mon Sep 17 00:00:00 2001
From: Nawid3333 <102778966+Nawid3333@users.noreply.github.com>
Date: Wed, 28 Oct 2026 21:17:50 +0100
Subject: [PATCH 2/3] Quote the logged range in the mislabelled-file spec
 (CodeQL js/log-injection)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 tests/e2e/ext-specs/mislabelled-file.e2e.mjs | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tests/e2e/ext-specs/mislabelled-file.e2e.mjs b/tests/e2e/ext-specs/mislabelled-file.e2e.mjs
index 998b47c86..a397757b2 100644
--- a/tests/e2e/ext-specs/mislabelled-file.e2e.mjs
+++ b/tests/e2e/ext-specs/mislabelled-file.e2e.mjs
@@ -178,7 +178,8 @@ describe('A Matroska file its server calls an MP4', function() {
     } finally {
       await browser.switchFrame(null);
       for (const r of filmRequests) {
-        console.log(`      request +${r.at - opened} ms ${r.range} referer ${r.referer ? 'page' : 'none'}`);
+        // The range JSON-quoted: a request's header cannot forge log lines (CodeQL js/log-injection).
+        console.log(`      request +${r.at - opened} ms ${JSON.stringify(r.range)} referer ${r.referer ? 'page' : 'none'}`);
       }
     }
     // Every one of the film's requests had the page's Referer: none went to the decoy.

From e5417282953e0cd29f33978731448e80ed034d14 Mon Sep 17 00:00:00 2001
From: Nawid3333 <102778966+Nawid3333@users.noreply.github.com>
Date: Wed, 28 Oct 2026 21:27:36 +0100
Subject: [PATCH 3/3] DIRECT's header rule asks for the 60 s cap (glm's review)

Firefox may hold a hidden tab's timers back: with a 30 s rule renewed every 10 s, a
renewal more than 20 s late left the element's next request without the page's
headers. At 60 s a renewal may come 50 s late.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 chrome/player/players/DirectVideoPlayer.mjs  | 6 ++++--
 docs/notes/player.md                         | 8 +++++---
 tests/e2e/ext-specs/mislabelled-file.e2e.mjs | 2 +-
 tests/unit/DirectVideoPlayer.test.mjs        | 8 +++++---
 types/messages.d.ts                          | 2 +-
 5 files changed, 16 insertions(+), 10 deletions(-)

diff --git a/chrome/player/players/DirectVideoPlayer.mjs b/chrome/player/players/DirectVideoPlayer.mjs
index d99e43ce0..db7f3a746 100644
--- a/chrome/player/players/DirectVideoPlayer.mjs
+++ b/chrome/player/players/DirectVideoPlayer.mjs
@@ -35,8 +35,10 @@ export function elementHeaderCommands(headers) {
 // it while it has the source. Firefox's player asks for ranges when it needs them: on a
 // seek, after a long pause, for a Matroska file's index at its end. A request's rule lives
 // 5 s, and those went out without the page's Referer or cookie: a hoster's server answered
-// the first one after 5 s with a redirect to a decoy, and the source was reloaded.
-export const HEADER_RULE_LIFETIME_MS = 30000;
+// the first one after 5 s with a redirect to a decoy, and the source was reloaded. The most
+// the background grants (MAX_RULE_LIFETIME_MS): Firefox may hold a hidden tab's timers back,
+// and a renewal up to 50 s late still comes before the rule ends.
+export const HEADER_RULE_LIFETIME_MS = 60000;
 export const HEADER_RULE_RENEW_MS = 10000;
 
 // What a direct video can be saved as. A URL without an extension (".../watch?v=1") was saved
diff --git a/docs/notes/player.md b/docs/notes/player.md
index d3c8d62de..5dff138ae 100644
--- a/docs/notes/player.md
+++ b/docs/notes/player.md
@@ -183,9 +183,11 @@ extension with a local copy of that shape:
   once, and every rule lived 5 s (`RuleEntry`): the element's first request after that (the
   Matroska index at the file's end, read 12 s in, or a seek) went out with no Referer, to the
   decoy, and the client's recovery reloaded the source (the buffer fell from 39 s to 9 s). The
-  element's rule now lives 30 s and is renewed every 10 s while the player has the source
-  (`SET_HEADERS`' `lifetimeMs`, capped at 60 s); a request's rule stays 5 s. After the player
-  is gone the rule lasts at most 30 s, limited to the extension's own requests in that tab.
+  element's rule now lives 60 s, the cap (`SET_HEADERS`' `lifetimeMs`), and is renewed every
+  10 s while the player has the source: Firefox may hold a hidden tab's timers back, and a
+  renewal up to 50 s late still comes in time (glm's review). A request's rule stays 5 s. After
+  the player is gone the rule lasts at most 60 s, limited to the extension's own requests to
+  that URL in that tab.
 
 The background's 64 KB read of the file (`StreamLengths`) sees the same bytes and could pick
 the player before MP4Player tries; not done yet: the hand-over costs one range.
diff --git a/tests/e2e/ext-specs/mislabelled-file.e2e.mjs b/tests/e2e/ext-specs/mislabelled-file.e2e.mjs
index a397757b2..b7daa906e 100644
--- a/tests/e2e/ext-specs/mislabelled-file.e2e.mjs
+++ b/tests/e2e/ext-specs/mislabelled-file.e2e.mjs
@@ -10,7 +10,7 @@
 // Firefox's own player in FastStream got the page's headers from a rule the background set
 // for 5 s, and asks for ranges whenever it needs them: the first request after those 5 s
 // (a Matroska file's index at its end, a seek) went to the decoy, and the source was
-// reloaded. Its rule now lives 30 s and is renewed while it has the source.
+// reloaded. Its rule now lives 60 s and is renewed every 10 s while it has the source.
 //
 // Driven on the installed extension, the site on the auto-enable list: the page plays the
 // film, the player takes it over, plays it, and plays on after a seek far ahead, 12 s in.
diff --git a/tests/unit/DirectVideoPlayer.test.mjs b/tests/unit/DirectVideoPlayer.test.mjs
index b64387f53..00da8a947 100644
--- a/tests/unit/DirectVideoPlayer.test.mjs
+++ b/tests/unit/DirectVideoPlayer.test.mjs
@@ -52,7 +52,8 @@ describe('saveExtension', () => {
 // Firefox's player asks for ranges whenever it needs them: on a seek, after a long pause, for
 // a Matroska file's index at its end. The rule set once lived 5 s, and the first request after
 // that went out without the page's Referer: a hoster's server sent it to a decoy, and the
-// source was reloaded. The rule now lives 30 s and is renewed while the player has the source.
+// source was reloaded. The rule now lives 60 s and is renewed every 10 s while the player has
+// the source: a hidden tab's timers may run late.
 describe('DirectVideoPlayer\'s header rule', () => {
   let sent;
   let player;
@@ -76,11 +77,12 @@ describe('DirectVideoPlayer\'s header rule', () => {
 
   const source = (headers) => /** @type {any} */ ({url: 'https://cdn.test/v/film', headers});
 
-  it('lives 30 s, and is renewed every 10 s while the player has the source', async () => {
+  it('lives 60 s, and is renewed every 10 s while the player has the source', async () => {
     await player.setSource(source({Referer: 'https://site.test/watch'}));
     expect(sent).toEqual([{type: 'SET_HEADERS', url: 'https://cdn.test/v/film', lifetimeMs: HEADER_RULE_LIFETIME_MS,
       commands: [{operation: 'set', header: 'Referer', value: 'https://site.test/watch'}]}]);
-    expect(HEADER_RULE_LIFETIME_MS).toBeGreaterThan(HEADER_RULE_RENEW_MS * 2);
+    expect(HEADER_RULE_LIFETIME_MS).toBe(60000);
+    expect(HEADER_RULE_LIFETIME_MS).toBeGreaterThanOrEqual(HEADER_RULE_RENEW_MS * 5);
     await vi.advanceTimersByTimeAsync(HEADER_RULE_RENEW_MS * 3);
     expect(sent).toHaveLength(4);
     expect(new Set(sent.map((message) => JSON.stringify(message))).size).toBe(1);
diff --git a/types/messages.d.ts b/types/messages.d.ts
index 9e204196a..bb620bfbd 100644
--- a/types/messages.d.ts
+++ b/types/messages.d.ts
@@ -97,7 +97,7 @@ interface FSSetHeaders extends FSMessageBase {
   commands: FSHeaderCommand[];
   /**
    * How long the rule lives, in ms: 5 s without it, at most 60 s (RuleEntry). Firefox's own
-   * player (DirectVideoPlayer) asks for longer and renews it while it has the source.
+   * player (DirectVideoPlayer) asks for 60 s and renews it every 10 s while it has the source.
    */
   lifetimeMs?: number;
 }