Handle Windows path aliases safely

Author: starsstreaming

packages/core/src/media-validation.ts

@@ -29,6 +29,22 @@ export class MediaValidationError extends Error {
   }
 }
 
+async function assertNoSymbolicLinkSegments(filePath: string): Promise<void> {
+  const root = path.parse(filePath).root;
+  const relative = path.relative(root, filePath);
+  let current = root;
+  for (const segment of relative.split(path.sep)) {
+    if (!segment) continue;
+    current = path.join(current, segment);
+    const segmentStat = await fs.lstat(current);
+    if (segmentStat.isSymbolicLink()) {
+      throw new MediaValidationError(
+        "Media path must not traverse a symbolic link or reparse point.",
+      );
+    }
+  }
+}
+
 export function isMp4Container(
   bytes: Uint8Array,
   totalSize: number = bytes?.byteLength ?? 0,
@@ -65,11 +81,9 @@ async function assertRegularFile(filePath: string): Promise<{
     return process.platform === "win32" ? resolved.toLowerCase() : resolved;
   };
   if (normalizeForCompare(realPath) !== normalizeForCompare(resolvedInput)) {
-    // realpath changed the path: an intermediate link or reparse point was
-    // traversed. The leaf-link case was rejected above.
-    throw new MediaValidationError(
-      "Media path must not traverse a symbolic link or reparse point.",
-    );
+    // realpath can also expand a harmless Windows 8.3 path alias. Inspect each
+    // segment so only an actual symlink or junction is rejected.
+    await assertNoSymbolicLinkSegments(resolvedInput);
   }
   const stat = await fs.stat(realPath);
   if (!stat.isFile()) {

packages/core/test/media-validation.test.js

@@ -61,6 +61,17 @@ test("validateVideoFile enforces extension, size, ftyp, no symlink", async () =>
       await fs.symlink(good, link);
       await assert.rejects(() => validateVideoFile(link), /symbolic link/);
     }
+
+    const linkedRoot = path.join(root, "linked-root");
+    await fs.symlink(
+      root,
+      linkedRoot,
+      process.platform === "win32" ? "junction" : "dir",
+    );
+    await assert.rejects(
+      () => validateVideoFile(path.join(linkedRoot, "background.mp4")),
+      /symbolic link|reparse point/,
+    );
   } finally {
     await fs.rm(root, { recursive: true, force: true });
   }