From 1bb58b59adf38450fbb4d4fcbb143c93b8d4f4fc Mon Sep 17 00:00:00 2001
From: fabi <fabi@mc02.dev>
Date: Mon, 29 Jun 2026 19:48:46 +0200
Subject: [PATCH] =?UTF-8?q?fix(security):=20re-review=20follow-ups=20?=
 =?UTF-8?q?=E2=80=94=20drop=20HEIC/HEIF,=20fix=20stale=20comment?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Address the two items from the adversarial re-review of batch-2.

- upload: remove image/heic + image/heif from ALLOWED_MEDIA. Neither the
  `image` crate nor the bundled ffmpeg 6.1 (Alpine 3.21 — HEIF demuxer
  only landed in ffmpeg 7.0) can decode them, so accepting them stored
  posts that never got a thumbnail. iOS Safari transcodes HEIC->JPEG on
  file-input selection, so this rejects only the rare HEIC-preserving
  path, now with a clear error instead of a silently broken post.
- data-mode-store: correct the stale "auth-gated" comment — the
  /original route is intentionally unauthenticated (UUID-as-capability)
  so it works from plain <img src> / <video src>.

Re-verified: cargo build (only the pre-existing middleware.rs warning).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 backend/src/handlers/upload.rs      | 8 ++++++--
 frontend/src/lib/data-mode-store.ts | 4 +++-
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/backend/src/handlers/upload.rs b/backend/src/handlers/upload.rs
index b04031e..2871805 100644
--- a/backend/src/handlers/upload.rs
+++ b/backend/src/handlers/upload.rs
@@ -21,13 +21,17 @@ const MAX_CAPTION_LENGTH: usize = 2000;
 /// we trust, store, and hand to the compression pipeline — so a text-based payload
 /// (SVG/HTML/JS) can never be stored or served on-origin. Each entry maps to the
 /// server-controlled file extension we persist the original under.
+///
+/// HEIC/HEIF are deliberately excluded: the preview pipeline (`image` crate, and
+/// the bundled ffmpeg 6.1) cannot decode them, so accepting them would store files
+/// that never get a thumbnail. iOS Safari already transcodes HEIC→JPEG when a photo
+/// is selected via a file input, so this rejects only the rare HEIC-preserving
+/// upload path — with a clear error rather than a silently broken post.
 const ALLOWED_MEDIA: &[(&str, &str)] = &[
     ("image/jpeg", "jpg"),
     ("image/png", "png"),
     ("image/webp", "webp"),
     ("image/gif", "gif"),
-    ("image/heic", "heic"),
-    ("image/heif", "heif"),
     ("video/mp4", "mp4"),
     ("video/quicktime", "mov"),
     ("video/webm", "webm"),
diff --git a/frontend/src/lib/data-mode-store.ts b/frontend/src/lib/data-mode-store.ts
index 171a838..3f80fde 100644
--- a/frontend/src/lib/data-mode-store.ts
+++ b/frontend/src/lib/data-mode-store.ts
@@ -1,5 +1,7 @@
 // Per-device "Datenmodus" — Saver loads compressed previews (default), Original loads
-// the full file via the auth-gated `/api/v1/upload/{id}/original` endpoint.
+// the full file via the `/api/v1/upload/{id}/original` endpoint. That route is
+// intentionally unauthenticated (the UUID acts as the capability) so it works from
+// plain `<img src>` / `<video src>` without an Authorization header.
 //
 // Stored per-device in localStorage (not per-user) because data plans are a property
 // of the device the guest is currently holding, not their identity.