Security context

Highlights

Auth Bypass: 49 prior fixes. Scrutinize any change in this area.

server/middlewares/validators/videos/videos.ts: most-fixed (6 issues). Treat as high-risk during review.

43 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

SSRF: Attackers can bypass server-side request restrictions to trigger requests targeting internal network services by supplying malicious import URLs that resolve to private or loopback IP addresses. Proper resolution validation must always occur immediately before executing the underlying worker process or fetch request.

Auth Bypass: Unlisted and private video assets could be accessed or modified without authorization if the system fails to validate request contexts properly (e.g., verifying user-scoped session identifiers on resumable uploads, or falling back to sequential database IDs instead of UUIDs). Verification parameters must be strictly mapped across both API routing tables and Nginx static delivery configurations.

Denial of Service: Server hangs, infinite loops, and resource exhaustion can easily occur during media processing of low frame-rate files or animated GIF structures. The main Node event loop must be insulated from blocking calculations by offloading ffmpeg commands and image processing tasks to dedicated worker threads with strict timeouts.