fix: add MIME type magic byte validation to prevent spoofed file uploads (#137)

[sachin-mahato25]

Closes #137

What changed

• Added validateVideoMagicBytes() in src/utils/video-validation.ts that reads the first 12 bytes of the uploaded file and checks them against known video format magic byte signatures
• Updated handleFile in src/components/FileUpload.tsx to be async and call the magic byte check before processing
• Added try/catch so file read failures show a friendly error message
• Validation runs before the file is passed to FFmpeg

Formats supported

• MP4 / MOV — ftyp box at byte offset 4
• WebM / MKV — EBML magic bytes 0x1A 0x45 0xDF 0xA3
• AVI — RIFF header
• OGG — OggS signature
• FLV — FLV\x01 signature
• MPEG-TS — sync byte 0x47
• MPEG-PS — pack start code
• 3GPP — ftyp3g at byte offset 4

Testing

• Renamed a .txt file to .mp4 → correctly rejected with error message
• Uploaded a real .mp4 video → loaded and processed normally

[vercel]

@sachin-mahato25 is attempting to deploy a commit to the magic-peach1's projects Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

✅ PR Format Check Passed — @sachin-mahato25

Basic format checks passed. A maintainer will review your code changes.

This does not mean the PR is approved — it just means the format is correct.

[github-actions]

👋 Thanks for your PR, @sachin-mahato25!

Welcome to Reframe — a browser-based video editor built for everyone 🎬

What happens next

1. 🤖 Automated checks — build & TypeScript typecheck will run automatically
2. ✅ Vercel preview — a preview deployment will be created (requires maintainer authorization for fork PRs)
3. 👀 Code review — a maintainer will review your changes
4. 🚀 Merge — once approved, your PR will be merged!

Quick checklist

• PR title follows Conventional Commits (e.g. feat: add dark mode)
• Linked the issue this PR closes (e.g. Closes #123)
• Tested the changes locally (bun run dev)
• Build passes (bun run build)

Useful links

• 📖 CONTRIBUTING.md
• 🐛 Open Issues
• ⭐ Star the repo to support the project!

Happy coding! 🎉

[sachin-mahato25]

Hey @magic-peach! I've worked on issue #137 and submitted a PR that adds magic byte validation to verify actual file headers instead of relying on extensions/MIME types. Tested with both fake and real video files. ✅

You can check it, verify and request for changes if needed.