fix(security): sanitize and validate URL recipe injection #1352

[Tarulatapriya]

Description

This PR addresses issue #1352 by enforcing strict validation and sanitization for Editor Recipes, preventing maliciously crafted URLs from crashing the app or the FFmpeg worker thread.

Fixes Made:

• src/lib/types.ts: Updated isValidRecipe to strictly type-check and range-check the inner fields of the textOverlays array.
• src/lib/editorPersistence.ts: Enhanced migrateRecipe with robust clamping for core recipe properties (quality, speed, brightness, resolution, etc.). Introduced sanitizeTextOverlay to clamp font sizes to a safe range (12-120), clamp x/y positions to 0-100, and strictly validate hexadecimal colors.
• src/hooks/useVideoEditor.ts:
  • updateRecipe: Now validates all values inside patches using isValidValue before applying them to state.
  • URL Parameter Clearing: If decodeRecipe fails to decode an invalid URL settings parameter, the app now actively removes the bad parameter using history.replaceState so that page reloads don't retry applying broken settings.

Related Issues

Fixes #1352

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• Security update

Additional Notes

• Contributing under GSSoC 2026.

[github-actions]

👋 Thanks for your PR, @Tarulatapriya!

Welcome to Reframe — a browser-based video editor built for everyone 🎬

🟠 GSSoC'26 PR detected — thanks for contributing under GirlScript Summer of Code 2026!

What happens next

1. 🤖 Automated checks — build & TypeScript typecheck will run automatically
2. ✅ Vercel preview — a preview deployment will be created (requires maintainer authorization for fork PRs)
3. 👀 Code review — a maintainer will review your changes
4. 🚀 Merge — once approved, your PR will be merged!

Quick checklist

• PR title follows Conventional Commits (e.g. feat: add dark mode)
• Linked the issue this PR closes (e.g. Closes #123)
• Tested the changes locally (bun run dev)
• Build passes (bun run build)

Useful links

• 📖 CONTRIBUTING.md
• 🐛 Open Issues
• ⭐ Star the repo to support the project!

Happy coding! 🎉

[github-actions]

✅ PR Format Check Passed — @Tarulatapriya

Basic format checks passed. A maintainer will review your code changes.

This does not mean the PR is approved — it just means the format is correct.

[Tarulatapriya]

I've submitted this PR to fix the URL recipe injection vulnerabilities (Issue #1352) under GSSoC '26.

Here’s a quick summary of what I did:

Validation: Updated isValidRecipe to tightly type-check and range-check the inner fields of the textOverlays array.
Sanitization: Added active clamping in migrateRecipe for core properties (quality, speed, width/height) and introduced sanitizeTextOverlay to clamp font sizes to a safe range, preventing out-of-bounds rendering crashes.
Safe State Updates: Wired isValidValue into the updateRecipe hook to prevent invalid patches, and added a self-healing URL feature that automatically clears the ?settings= parameter if a corrupted recipe string is detected on page load.
Let me know if this looks good to merge or if you need any adjustments! 🚀