release: v4.8.11 file transfer reliability fix
CodeQL Analysis / Analyze CodeQL (push) Has been cancelled
Deploy Application / deploy (push) Has been cancelled
Mirror to Codeberg / mirror (push) Has been cancelled
Mirror to PrivacyGuides / mirror (push) Has been cancelled

fix(file-transfer): size chunks under the 64KB SCTP message limit

Each 64KB chunk became a ~87KB AES-GCM+Base64 file_chunk message,
exceeding WebRTC's 64KB SCTP message-size floor. The consent handshake
(small messages) succeeded, but no chunk was ever delivered on Safari
and cross-browser connections whose SDP omits a=max-message-size, so
files never transferred. Send chunk size is now 16KB (~22KB on the
wire); inbound chunks up to 64KB stay accepted for backward compat.

fix(file-transfer): make MIME advisory, drive validation by extension

The client-supplied MIME type is easily spoofed and varies across
browsers/OSes, yet was a hard gate: files with an empty MIME or a
cross-OS variant (application/x-zip-compressed, image/jpg) were wrongly
rejected. Extension allow-list plus BLOCKED_EXTENSIONS is now the
boundary; a blatantly foreign MIME on a safe extension is still rejected
and per-type size limits still apply.
This commit is contained in:
lockbitchat
2026-06-16 18:24:29 -04:00
parent 9244250835
commit be1d02f1f7
10 changed files with 133 additions and 60 deletions
+7 -7
View File
@@ -1,10 +1,10 @@
{
"version": "1781588965220",
"buildVersion": "1781588965220",
"appVersion": "4.8.10",
"buildTime": "2026-06-16T05:49:25.266Z",
"buildId": "1781588965220-6dac4ce",
"gitHash": "6dac4ce",
"version": "1781648539643",
"buildVersion": "1781648539643",
"appVersion": "4.8.11",
"buildTime": "2026-06-16T22:22:19.692Z",
"buildId": "1781648539643-9244250",
"gitHash": "9244250",
"generated": true,
"generatedAt": "2026-06-16T05:49:25.268Z"
"generatedAt": "2026-06-16T22:22:19.693Z"
}