feat: publish av-tools 0.1.0

2026-07-24 14:58:03 +02:00
commit fcc537b024
254 changed files with 63270 additions and 0 deletions
--- a/docs/SECURITY.md
+++ b/docs/SECURITY.md
@@ -0,0 +1,140 @@
+# Security and privacy
+
+## Trust boundary
+
+Imported media, filenames, container metadata, tags, chapters, subtitles,
+attachments, codec logs, project JSON and Toolbox context are untrusted. FFmpeg
+parsing occurs in a worker but still consumes memory/CPU in the user's browser.
+The application cannot make a malicious codec safe; it limits exposure and
+keeps cleanup/recovery explicit.
+
+The supported product has:
+
+- no upload or processing backend;
+- no telemetry, analytics or third-party runtime script;
+- no remote-media protocol or automatic external fetch;
+- no shell/native command execution;
+- no arbitrary FFmpeg command input;
+- no persistent source copy in the current application.
+
+Browser extension, operating-system, reverse-proxy and compromised dependency
+behavior remain outside this boundary.
+
+## Paths and command construction
+
+User names are display labels only. Virtual filesystem paths are generated from
+job ids plus sanitized, length-bounded basenames; separators, traversal,
+control characters, reserved names and collisions are handled centrally.
+Outputs must be declared in a typed plan before execution.
+
+Commands are argument arrays assembled from discriminated operation/preset
+types. No shell parses them. Filters, metadata, concat lists, chapter metadata
+and subtitle values use syntax-specific escaping; one escaping routine is not
+reused across incompatible grammars. Capability requirements are checked before
+execution. Logs are line/byte bounded and local path-like names are redacted in
+exportable diagnostics.
+
+## Rendering and external URLs
+
+Metadata is rendered as React text, never `dangerouslySetInnerHTML`. Subtitle
+text is parsed and rendered or sent through a generated local file; it is not
+inserted as HTML. Extracted URLs are inert text. The application does not open
+links from media automatically. No remote font is fetched; ASS burn-in uses
+packaged/system-generic font configuration only when the required local
+capability is available.
+
+Preview/download URLs are `blob:` values made from local bytes. They are
+revoked on replacement, project close and unmount. Browser support for a
+container is not evidence that its contents are safe or fully decodable.
+
+## Resource controls
+
+The administrator-adjustable defaults are product limits, not FFmpeg limits:
+
+| Limit                             |           Default |
+| --------------------------------- | ----------------: |
+| soft input warning                |           256 MiB |
+| hard single input                 |          1536 MiB |
+| hard total input                  |          1536 MiB |
+| soft output estimate              |           512 MiB |
+| hard output estimate              |          1024 MiB |
+| concurrent FFmpeg jobs            |                 1 |
+| scheduled operations in memory    |                 8 |
+| timeline clips                    |               100 |
+| streams per input                 |                64 |
+| image dimension / pixel count     | 8192 / 67,108,864 |
+| generated outputs / contact cells |         255 / 500 |
+| job runtime                       |           4 hours |
+
+Before allocation, the application estimates source/output bytes, duration,
+resolution, frame/pixel work, passes, retained results and output count.
+Estimates are labelled as estimates. Hard-limit violations do not start; soft
+violations explain resolution/duration/output-count alternatives. The
+255-output limit keeps a whole managed batch saveable in the 256-entry ZIP
+limit with an optional report. Memory-constrained devices receive stronger
+warnings only when a reliable browser signal exists.
+
+WASM itself has a documented 2 GiB input ceiling; practical browser limits can
+be much lower, especially when input and output coexist. Archive/export and
+cache operations also enforce entry, total-size and path limits.
+
+## Workers and cancellation
+
+Wrapper, core, pthread and waveform workers are same-origin or short-lived
+`blob:` workers created by trusted application code. OPFS caching currently
+uses asynchronous browser file handles rather than a separate storage worker.
+MT requires shared memory and cross-origin isolation. ST loads when isolation
+is absent. Cancelling FFmpeg terminates and discards its worker/core; a new
+instance is required before another job. Stale generations cannot commit a
+result.
+
+## Content Security Policy
+
+Tested deployment policy target:
+
+```text
+default-src 'self';
+script-src 'self' 'wasm-unsafe-eval';
+worker-src 'self' blob:;
+connect-src 'self';
+img-src 'self' blob: data:;
+media-src 'self' blob:;
+font-src 'self';
+style-src 'self';
+object-src 'none';
+frame-src 'none';
+frame-ancestors 'none';
+base-uri 'none';
+form-action 'none';
+```
+
+Do not replace `'wasm-unsafe-eval'` with broad `'unsafe-eval'`. All core assets
+are same-origin. `media-src blob:` is required for result/source previews.
+The exact headers, immutable Portal reference gap and active-worktree local
+patch are in `docs/PORTAL_REQUIREMENTS.md`.
+
+## Cross-origin isolation
+
+MT needs secure HTTPS (localhost during development is acceptable),
+`SharedArrayBuffer`, and:
+
+```text
+Cross-Origin-Opener-Policy: same-origin
+Cross-Origin-Embedder-Policy: require-corp
+Cross-Origin-Resource-Policy: same-origin
+```
+
+Isolation affects every resource in the page. Do not weaken COEP or allow
+cross-origin dependencies merely to make MT load. The safe fallback is ST.
+
+## Dependency and vulnerability response
+
+Exact runtime versions and core digests are recorded in `SOURCE.md`. Run
+`npm audit`, tests, real core smoke tests and legal review before an update.
+Core upgrades change a large native attack surface and require new capability
+snapshots, fixtures, checksums and browser tests.
+
+Report vulnerabilities privately to the repository owner through the Gitea
+instance when possible. Do not attach sensitive media, credentials or an
+unredacted diagnostic log to a public issue. Include the app/core version,
+browser, mode, smallest synthetic reproduction, impact and cleanup result.