fix(photos,forms): own-property content types, dimension bounds, VP8L signature, trimmed inputs

src/lib/server/forms/expense-form.ts

@@ -57,7 +57,8 @@ export function buildExpenseBody(v: ExpenseFormValues, opts: BuildOptions): Buil
 	const errors: FieldErrors = {};
 	const active = new Set(opts.activeMemberIds);
 
-	if (v.description.length === 0 || v.description.length > 120) errors.description = 'Description is required (max 120 characters)';
+	const description = v.description.trim();
+	if (description.length === 0 || description.length > 120) errors.description = 'Description is required (max 120 characters)';
 	const amountCents = parseAmountToCents(v.amount);
 	if (amountCents === null) errors.amount = 'Enter a positive amount with at most 2 decimals';
 	if (!isValidDate(v.date)) errors.date = 'Enter a valid date';
@@ -106,7 +107,7 @@ export function buildExpenseBody(v: ExpenseFormValues, opts: BuildOptions): Buil
 	}
 
 	if (Object.keys(errors).length > 0 || !split || amountCents === null) return { ok: false, errors };
-	const body: ExpenseBody = { description: v.description, amountCents, currency: opts.currency, date: v.date, paidBy: v.paidBy, split, shares };
+	const body: ExpenseBody = { description, amountCents, currency: opts.currency, date: v.date, paidBy: v.paidBy, split, shares };
 	const trimmedNotes = v.notes.trim();
 	if (trimmedNotes.length > 0) body.notes = trimmedNotes;
 	return { ok: true, body };

src/lib/server/forms/settlement-form.ts

@@ -16,7 +16,8 @@ export function settlementToFormValues(s: Settlement): SettlementFormValues {
 
 /** Prefill from `/balances` "Settle up" links: ?from=&to=&amount=. */
 export function settlementFormFromQuery(q: URLSearchParams, viewerId: string, today: string): SettlementFormValues {
-	return { from: q.get('from') ?? viewerId, to: q.get('to') ?? '', amount: q.get('amount') ?? '', date: today, note: '' };
+	const clip = (v: string): string => v.trim().slice(0, 64);
+	return { from: clip(q.get('from') ?? viewerId), to: clip(q.get('to') ?? ''), amount: clip(q.get('amount') ?? ''), date: today, note: '' };
 }
 
 export function buildSettlementBody(v: SettlementFormValues, activeMemberIds: string[]): BuildResult<SettlementBody, SettlementField> {

src/lib/server/photos.ts

@@ -12,7 +12,7 @@ export function photoKey(expenseId: string, photoId: string, type: ImageType): s
 
 export function contentTypeForKey(key: string): string {
 	const ext = key.slice(key.lastIndexOf('.') + 1);
-	return TYPE_BY_EXT[ext] ?? 'application/octet-stream';
+	return Object.hasOwn(TYPE_BY_EXT, ext) ? TYPE_BY_EXT[ext] : 'application/octet-stream';
 }
 
 export function sniffImageType(b: Uint8Array): ImageType | null {
@@ -22,6 +22,8 @@ export function sniffImageType(b: Uint8Array): ImageType | null {
 	return null;
 }
 
+export const MAX_IMAGE_DIMENSION = 20_000;
+
 export function imageDimensions(b: Uint8Array, type: ImageType): { width: number; height: number } | null {
 	const dv = new DataView(b.buffer, b.byteOffset, b.byteLength);
 	try {
@@ -56,6 +58,7 @@ export function imageDimensions(b: Uint8Array, type: ImageType): { width: number
 		if (chunk === 'VP8X' && b.length >= 30) return check(1 + u24le(b, 24), 1 + u24le(b, 27));
 		if (chunk === 'VP8 ' && b.length >= 30) return check(dv.getUint16(26, true) & 0x3fff, dv.getUint16(28, true) & 0x3fff);
 		if (chunk === 'VP8L' && b.length >= 25) {
+			if (b[20] !== 0x2f) return null;
 			const w = 1 + (((b[22] & 0x3f) << 8) | b[21]);
 			const h = 1 + (((b[24] & 0x0f) << 10) | (b[23] << 2) | ((b[22] & 0xc0) >> 6));
 			return check(w, h);
@@ -73,5 +76,5 @@ function u24le(b: Uint8Array, i: number): number {
 	return b[i] | (b[i + 1] << 8) | (b[i + 2] << 16);
 }
 function check(width: number, height: number): { width: number; height: number } | null {
-	return width > 0 && height > 0 ? { width, height } : null;
+	return width > 0 && height > 0 && width <= MAX_IMAGE_DIMENSION && height <= MAX_IMAGE_DIMENSION ? { width, height } : null;
 }

tests/unit/forms/expense-form.test.ts

@@ -54,6 +54,11 @@ describe('buildExpenseBody', () => {
 		expect(r2.ok && r2.body.notes).toBe('hi');
 	});
 
+	it('trims the description before storing it', () => {
+		const r = buildExpenseBody({ ...base, description: '   Pizza  ' }, opts);
+		expect(r.ok && r.body.description).toBe('Pizza');
+	});
+
 	it('reports field errors', () => {
 		const errs = (v: Partial<typeof base>) => {
 			const r = buildExpenseBody({ ...base, ...v }, opts);

tests/unit/forms/settlement-form.test.ts

@@ -30,4 +30,13 @@ describe('settlement form', () => {
 		expect(settlementFormFromQuery(q, 'u_b', '2026-08-29')).toEqual({ from: 'u_b', to: 'u_a', amount: '90.00', date: '2026-08-29', note: '' });
 		expect(settlementFormFromQuery(new URLSearchParams(), 'u_b', '2026-08-29')).toEqual({ from: 'u_b', to: '', amount: '', date: '2026-08-29', note: '' });
 	});
+
+	it('trims and truncates query-derived values', () => {
+		const q = new URLSearchParams({ from: '  u_b  ', to: '  u_a  ', amount: `  ${'9'.repeat(200)}  ` });
+		const values = settlementFormFromQuery(q, 'u_b', '2026-08-29');
+		expect(values.from).toBe('u_b');
+		expect(values.to).toBe('u_a');
+		expect(values.amount).toBe('9'.repeat(64));
+		expect(values.amount.length).toBe(64);
+	});
 });

tests/unit/photos.test.ts

@@ -23,6 +23,24 @@ const webpX = (w: number, h: number) => {
 	b.set([hh & 0xff, (hh >> 8) & 0xff, (hh >> 16) & 0xff], 27);
 	return b;
 };
+const vp8L = (w: number, h: number, sig = 0x2f) => {
+	const b = new Uint8Array(25);
+	b.set([0x52, 0x49, 0x46, 0x46, 0, 0, 0, 0, 0x57, 0x45, 0x42, 0x50, 0x56, 0x50, 0x38, 0x4c], 0);
+	b[20] = sig;
+	const ww = w - 1, hh = h - 1;
+	b[21] = ww & 0xff;
+	b[22] = ((ww >> 8) & 0x3f) | ((hh & 0x3) << 6);
+	b[23] = (hh >> 2) & 0xff;
+	b[24] = (hh >> 10) & 0x0f;
+	return b;
+};
+const vp8Lossy = (w: number, h: number) => {
+	const b = new Uint8Array(30);
+	b.set([0x52, 0x49, 0x46, 0x46, 0, 0, 0, 0, 0x57, 0x45, 0x42, 0x50, 0x56, 0x50, 0x38, 0x20], 0);
+	new DataView(b.buffer).setUint16(26, w, true);
+	new DataView(b.buffer).setUint16(28, h, true);
+	return b;
+};
 
 describe('photos', () => {
 	it('sniffs types by magic bytes', () => {
@@ -40,6 +58,26 @@ describe('photos', () => {
 		expect(imageDimensions(new Uint8Array([0xff, 0xd8, 0xff]), 'image/jpeg')).toBeNull();
 	});
 
+	it('rejects absurd or oversized dimensions', () => {
+		expect(imageDimensions(png(4294967295, 4294967295), 'image/png')).toBeNull();
+		expect(imageDimensions(png(20000, 1), 'image/png')).toEqual({ width: 20000, height: 1 });
+		expect(imageDimensions(png(20001, 1), 'image/png')).toBeNull();
+	});
+
+	it('parses VP8L only when the signature byte is correct', () => {
+		expect(imageDimensions(vp8L(3, 2), 'image/webp')).toEqual({ width: 3, height: 2 });
+		expect(imageDimensions(vp8L(3, 2, 0x00), 'image/webp')).toBeNull();
+	});
+
+	it('parses VP8 (lossy) dimensions', () => {
+		expect(imageDimensions(vp8Lossy(100, 50), 'image/webp')).toEqual({ width: 100, height: 50 });
+	});
+
+	it('returns null promptly for a zero-length JPEG segment with no trailing data', () => {
+		const b = new Uint8Array([0xff, 0xd8, 0xff, 0xe0, 0x00, 0x00]);
+		expect(imageDimensions(b, 'image/jpeg')).toBeNull();
+	});
+
 	it('builds and recognises keys', () => {
 		const key = photoKey('e_01HZXXXXXXXXXXXXXXXXXXXXXX', '01HZYYYYYYYYYYYYYYYYYYYYYY', 'image/jpeg');
 		expect(key).toBe('photos/e_01HZXXXXXXXXXXXXXXXXXXXXXX/01HZYYYYYYYYYYYYYYYYYYYYYY.jpg');
@@ -47,5 +85,6 @@ describe('photos', () => {
 		expect(PHOTO_KEY_RE.test('photos/../users.json')).toBe(false);
 		expect(contentTypeForKey(key)).toBe('image/jpeg');
 		expect(contentTypeForKey('photos/e_X/y.webp')).toBe('image/webp');
+		expect(contentTypeForKey('photos/e_X/y.constructor')).toBe('application/octet-stream');
 	});
 });