feat: Security

toju-app/src/app/domains/attachment/application/services/attachment-transfer.service.ts

@@ -340,7 +340,12 @@ export class AttachmentTransferService {
       !messageId || !fileId ||
       typeof index !== 'number' ||
       typeof total !== 'number' ||
-      typeof data !== 'string'
+      typeof data !== 'string' ||
+      !Number.isInteger(index) ||
+      !Number.isInteger(total) ||
+      total <= 0 ||
+      index < 0 ||
+      index >= total
     ) {
       return;
     }
@@ -351,6 +356,14 @@ export class AttachmentTransferService {
     if (!attachment)
       return;
 
+    if ((attachment.receivedBytes ?? 0) > attachment.size) {
+      return;
+    }
+
+    if (!this.shouldReceiveToDisk(attachment) && attachment.size > MAX_AUTO_SAVE_SIZE_BYTES) {
+      return;
+    }
+
     if (this.shouldReceiveToDisk(attachment)) {
       this.enqueueDiskFileChunk(attachment, {
         data,