feat(web): preview archives, sqlite databases, and decoded images#21467

🟠 High files/imageDecode.worker.ts:130

TIFFs with a non-default Orientation tag fail to produce a preview, so valid camera or scanner images (for example, Orientation=6) show “Unable to load image.” The decodeTiff call at line 130 reaches tiff@7.1.3's decodeImageData, which throws Unsupported orientation; handle the orientation before decoding or reject it explicitly with a clear error.

Nondefault TIFF orientation now produces an explicit unsupported-orientation error before pixel decoding in 5b24af6040.

🟠 High files/imageDecode.worker.ts:104

PackBits-compressed TIFFs pass this validation but fail during decodeTiff, so valid images using compression 32773 cannot be previewed. The tiff decoder throws Unsupported Compression: PackBits; reject 32773 here unless a PackBits decoder is added.

PackBits is rejected by strip validation with the unsupported-compression error in 5b24af6040.

🟡 Medium files/binaryPreview.worker.ts:165

A valid empty ZIP uploaded as download with MIME application/zip falls through to tarEntries and is rejected as having no readable entries. This branch recognizes ZIPs only by filename or the local-file signature; also recognize the ZIP end-of-central-directory signature (or pass the known ZIP format through).

Recognizes the empty ZIP end-of-central-directory signature in 5b24af6040, including extensionless uploads.

🟠 High files/boundedZip.ts:22

Valid ZIP64 archives with at most 2,048 entries are rejected as oversized, so ZIP64 ZIP/JAR/DOCX files cannot be previewed. ZIP64 uses 0xffff in this legacy EOCD field as a sentinel rather than the actual count; validate the ZIP64 count or defer this limit to the parsed entries.length check below.

Validates bounded ZIP64 directory counts and offsets in 5b24af6040. The existing browser suite successfully reads a generated small ZIP64 archive.

🟠 High files/binaryPreview.worker.ts:169

A ZIP/JAR with any member larger than 10 MB fails here before its entries are listed, so users cannot browse the archive even though the entry handler is intended to reject only opening oversized members. Pass the 50 MB BINARY_PREVIEW_MAX_BYTES limit to enumeration and keep the 10 MB check in the entry handler.

Enumeration now allows members up to the existing 50 MB archive budget in 5b24af6040. Opening a member retains the 10 MB limit.

🟠 High files/imageDecode.worker.ts:123

Tiled RGB/RGBA previews are emitted with missing color channels, so the resulting PNG is incorrect. The tiled path in tiff's readTileData writes only one sample per pixel, but this worker accepts multi-component tiled images and converts their data as RGB; reject tiled images with more than one component or decode all samples.

Rejects multicomponent tiled TIFFs before pixel decoding in 5b24af6040, since the installed decoder does not read those samples correctly.

🟡 Medium files/AttachmentFilePreview.tsx:281

When an image fails to load, PreviewImage shows its local failure surface instead of setting this component’s error, so the parent FileSurfaceFailure and its retry action never appear. Report image load failures through setError so retry can refresh the asset URL and reload the image.

Image errors now reach the attachment failure surface in 5b24af6040. The browser regression clicks retry and verifies that asset authorization refreshes twice and the replacement image loads.

🟠 High files/boundedZip.ts:26

A ZIP can declare at most 2,048 entries here while containing hundreds of thousands of central-directory records, causing JSZip.loadAsync(bytes) to allocate an object for every record before the later entries.length check; opening it can exhaust the preview worker's memory or hang it. The check reads only the EOCD's declared count, but JSZip 3.10.1 parses records until it reaches the end of the directory, so validate the actual record count with a byte-size bound before calling loadAsync, or use a parser that enforces the limit during parsing.

Counts actual central-directory records and validates their spans before JSZip allocates entries in 5b24af6040. A 2,049-record archive claiming one record is rejected by the browser regression.

🟠 High files/imageDecode.worker.ts:120

A crafted TIFF under the 50 MB input limit can exhaust renderer memory before the preview bounds are applied. decodeTiff allocates and retains metadata arrays based on each tag’s numValues, even with ignoreImageData, so repeated references to the same payload can cause gigabytes of allocations; validate IFD entry counts, value spans, and cumulative metadata size before calling it.

Validates IFD depth, entry counts, tag spans, pointers, and cumulative metadata allocations before calling the TIFF decoder in 5b24af6040. Oversized metadata is rejected through the real worker in the browser suite.

🟠 High files/imageDecode.worker.ts:145

WhiteIsZero TIFF pixels render with inverted brightness: black appears white and vice versa. The tiff decoder already inverts samples for image.type === 0, so this second inversion reverses them again; use the decoded gray value directly.

Removed the duplicate WhiteIsZero inversion in 5b24af6040. A real-worker browser check verifies the resulting white and black RGBA pixels.

🟠 High files/BinaryViewer.tsx:174

An archive file and directory with the same basename collapse into one child, so one of them becomes inaccessible—for example, foo and foo/bar.txt both map to children.get("foo"). Key children by both path and entry type so the file and directory remain distinct.

Archive child and React row keys now distinguish files from directories in 5b24af6040. The browser regression and actual app both open the root file while retaining the same-named folder.

🟡 Medium files/binaryPreview.worker.ts:66

GNU-format TAR entries with access timestamps in bytes 345–499 are listed and stored under a fabricated path because tarEntries treats those fields as a USTAR prefix without checking the header format. Gate prefix parsing on the POSIX USTAR magic and version so these entries retain their actual paths.

TAR prefix parsing now requires POSIX USTAR magic and version 00 in 5b24af6040, preserving GNU-format entry names.

🟠 High files/binaryPreview.worker.ts:76

TARs with a PAX size override are rejected instead of previewed, and their file contents are lost. The x record handling only preserves path, so the following entry uses its header size of 0 to slice the content and advance the offset; the padded hello payload is then parsed as a damaged header. Preserve the PAX size value and apply it to the following entry's content slice and offset advancement, subject to the existing size bounds.

Fixed in 53395e974567191c27878e7e2386736ceb4c6231. The next file consumes the local PAX size override for its content slice and padded offset, while metadata uses its own header size. Nondecimal, unsafe and oversized overrides are rejected; the real client opens the hello payload and the browser check also rejects an oversized override.

🟠 High files/binaryPreview.worker.ts:118

SQLite previews omit generated columns because PRAGMA table_info excludes them and this list is the sole source for the SELECT columns. A table with price, quantity, and stored generated total therefore never displays total; use table_xinfo with appropriate hidden-column filtering before applying the 50-column limit.

Fixed in 53395e974567191c27878e7e2386736ceb4c6231. table_xinfo includes stored and virtual generated columns; hidden columns are filtered before the 50-column limit. Verified total=21 and doubled=14 through the real client and browser worker check.

🟡 Medium files/BinaryViewer.tsx:190

Archive entries with repeated separators can trap users in a folder they cannot leave: entering the empty path segment sets folder to a//, and the parent-folder regex matches nothing, so clicking “Parent folder” leaves the folder unchanged. Update the regex to remove the final component even when it is empty.

Fixed in 53395e974567191c27878e7e2386736ceb4c6231. Parent navigation now removes an empty final path component. Verified entering a// in a real TAR and returning to the archive root, with a focused browser regression check.

🟠 High files/binaryPreview.worker.ts:85

Valid TAR archives with global PAX attributes are rejected or misparsed because this branch discards every type === "g" attribute; for example, a global size=5 is ignored, so the parser treats a zero-size file as empty and reads its payload as the next header. Preserve global attributes for subsequent entries and apply per-file PAX attributes as overrides.

Fixed in c8957ed1bd. Global PAX attributes persist across entries, with local overrides cleared after one entry and empty global attributes removing inherited values. The real worker check covers inherited size, a local size override, and restoration of the global size.

🟡 Medium files/binaryPreview.worker.ts:100

TAR entries with a PAX mtime override are reported with the legacy header timestamp, so a pre-epoch entry with a zero fallback timestamp appears as January 1970. The extended-header parser only retains path and size, and this line always reads the legacy octal field; retain the PAX mtime and use it when constructing the entry date.

Fixed in c8957ed1bd. PAX mtime overrides now supply the entry timestamp, including signed fractional seconds and pre-epoch dates. The worker check and actual archive view show December 1969.

🟠 High files/binaryPreview.worker.ts:170

Databases containing user tables such as sqliteData omit those tables from the preview, and a database with only such tables appears to have no readable tables. In name NOT LIKE 'sqlite_%', _ matches any single character, so use a literal-prefix comparison to exclude only names beginning with sqlite_.

Fixed in c8957ed1bd. The SQLite query excludes only the literal sqlite_ prefix. The browser check and actual app both render sqliteData with its stored and virtual generated values.

🟠 High files/binaryPreview.worker.ts:83

Valid PAX archives with a newline in path have that path truncated, and continuation text can be treated as a separate size record, setting the wrong paxSize and truncating or rejecting the following entry. split("\n") ignores PAX records’ declared byte lengths; parse records by those lengths so embedded newlines remain part of the value.

Fixed in c8957ed1bd. PAX records now advance by declared byte length, preserving embedded newlines and UTF-8 paths without treating continuation text as metadata. The real worker test preserves the exact path and reads its full hello payload.

🟠 High files/boundedZip.ts:53

A crafted ZIP64 archive can pass this preflight while JSZip.loadAsync follows an earlier ZIP64 record and allocates its oversized directory before the post-load entry limit runs. The locator offset is only checked to be no greater than record, so require it to equal the record validated here.

Fixed in 54bf5e814a. The ZIP64 locator must point exactly at the validated end record, so JSZip cannot follow an earlier unbounded record. The redirected-record regression and all 1,281 browser tests pass.

External image Minor · Performance & Scalability · Quick win

Copy TAR entry bytes out of the archive buffer before you store or send them.

Line 90 creates content with bytes.subarray(...). The view therefore shares the complete TAR buffer, or the complete decompressed .tar.gz buffer. Line 133 stores that view in files. Line 147 then posts the view with transfer: []. Structured clone serializes the complete underlying ArrayBuffer of a typed-array view, not only the view's byte range. As a result, each click on a small entry in a 50 MB TAR copies up to 50 MB to the main thread, and entry.bytes.buffer keeps that full copy alive. The ARCHIVE_ENTRY_MAX_BYTES check at Line 145 checks the view length, so it does not limit this copy.

Store a compact copy for each TAR entry. ZIP entries already use their own buffers from boundedZip.

The zero-copy-transfer learning does not apply here. A transfer would detach the cached entry and break a second open of the same entry.

✅ Confirmed as addressed by @maria-rcks

Fixed in 11644299c1. TAR entries now cache content.slice(), so structured cloning sends only the entry buffer and leaves the cached entry reusable. The existing real-worker PAX test verifies the five-byte backing buffer, mutates the received copy, and reopens the entry with its original bytes intact.

@maria-rcks Thanks for the fix. content.slice() gives each cached TAR entry a compact buffer without detaching it on reply. The reported PAX test covers buffer size, copy isolation, and repeated opens.

📝 I couldn't check this conversation for new learnings, so no new learning was saved.

If you found this review helpful, would you consider giving us a shout-out on X?

Thank you for using CodeRabbit!

✅ Review thread resolved.

_{You are interacting with an AI system.}