Skip to content

fix(player): reject non-finite composition dimensions from attributes and stage-size#1205

Open
calcarazgre646 wants to merge 1 commit into
heygen-com:mainfrom
calcarazgre646:fix/player-dimension-validation
Open

fix(player): reject non-finite composition dimensions from attributes and stage-size#1205
calcarazgre646 wants to merge 1 commit into
heygen-com:mainfrom
calcarazgre646:fix/player-dimension-validation

Conversation

@calcarazgre646
Copy link
Copy Markdown
Contributor

Problem

Two of the three paths that set the player's composition dimensions skip validation, and both feed scaleIframeToFit()'s w / compositionWidth division (iframe-dom.ts:70):

  1. width/height attributes (hyperframes-player.ts:174-179): raw parseInt(val || "1920", 10). A typo in the embed like width="abc" produces NaN, which lands in the iframe as an invalid scale(NaN) transform plus width: NaNpx; width="0" produces a division by zero (scale(Infinity)); negative values flip the iframe. In every case the player renders blank with no signal about why.
  2. stage-size runtime message (runtime-message-handler.ts:88-93): the > 0 check alone lets Infinity through (Infinity > 0 is true), which scales the iframe to 0 and blanks it.

The third path already validates: the composition probe rejects non-finite and non-positive dimensions via readPositiveDimension() before they reach the same sink. And the inconsistency is local in both cases — the timeline branch directly above the stage-size check does finite-check its input, and playback-rate in the same attribute switch goes through clampPlaybackRate (#1120).

Change

  • Export readPositiveDimension from composition-probe.ts and use it for the width/height attributes, falling back to the 1920/1080 defaults the val || ... pattern already implied.
  • Add the same Number.isFinite guard the adjacent timeline branch uses to the stage-size check.

No behavior change for valid inputs: finite positive dimensions parse exactly as before.

Tests

  • Attribute path: valid values apply; non-numeric, zero, and negative fall back to defaults; removing the attribute restores defaults. The non-numeric and zero cases fail against the previous code.
  • stage-size path (new runtime-message-handler.test.ts): finite positive sizes apply; Infinity/NaN/zero/negative/string sizes are ignored (the Infinity cases fail against the previous code); messages from a different source window are ignored.
  • Full player suite: 132 passed. bun run build green.

… and stage-size

width/height attributes went through parseInt with no validation, so a
typo like width="abc" reached scaleIframeToFit as NaN (invalid
scale(NaN) transform) and width="0" as a division by zero — both
blank the player with no signal. The stage-size message check had the
sibling gap: `> 0` alone lets Infinity through, which scales the
iframe to 0.

Reuse the composition probe's readPositiveDimension guard for the
attribute path (the probe path already rejected these) and add the
same finite-check the adjacent timeline branch uses for stage-size.
Mirrors the clampPlaybackRate hardening from heygen-com#1120.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants