improvement(files): drop the dead preview reset and cap the ftyp brand scan

- Content writes mint a new storage key, so the parent's key={file.key}
  already remounts ImagePreview; the render-phase reset was unreachable and
  made renames flash a loading overlay.
- Clamp the ftyp compatible-brand scan to a real box size. The declared size
  is attacker-controlled and this now runs on every preview request.
- UnsupportedPreview takes a primitive name so memo is load-bearing.
- Fix the hardcoded ? in the public preview URL builder.

Author: waleedlatif1

apps/sim/app/api/files/serve/[...path]/route.ts

@@ -57,9 +57,8 @@ async function resolveServableBytes(params: {
   if (options.raw) return { buffer, contentType: getContentType(filename) }
 
   if (options.preview) {
-    // Images resolve first and independently of the document path: a HEIF has no
-    // compiled-source concept, and its derivative is keyed by storage key rather
-    // than by source hash.
+    // Images resolve independently of the document path: a HEIF has no compiled-source
+    // concept, so it never reaches the doc branch.
     const image = await resolveServableImageBytes(buffer, storageKey)
     if (image) return image
   }

apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/file-viewer.tsx

@@ -171,7 +171,7 @@ function FileViewerContent({
       // browser. CsvTablePreview's streamed fallback is workspace-only, so on the
       // read-only public path a large CSV is download-only.
       if (isCsvStreamOnly(file)) {
-        return <UnsupportedPreview file={file} />
+        return <UnsupportedPreview name={file.name} />
       }
       // Markdown renders through the inline rich editor (non-editable) so the public share
       // surface matches the in-app reading experience; canEdit={false} disables autosave,
@@ -260,7 +260,7 @@ function FileViewerContent({
     return <XlsxPreview key={file.id} file={file} workspaceId={workspaceId} />
   }
 
-  return <UnsupportedPreview file={file} />
+  return <UnsupportedPreview name={file.name} />
 }
 
 /**

apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/image-preview.test.tsx

@@ -69,17 +69,18 @@ describe('ImagePreview', () => {
     expect(container.textContent).toContain('Preview not available')
   })
 
-  it('retries when the file is overwritten, which keeps the same storage key', () => {
-    render()
+  it('retries after an overwrite, which mints a new storage key and remounts', () => {
+    act(() => root.render(<ImagePreview key={file.key} file={file} />))
 
     act(() => {
       container.querySelector('img')?.dispatchEvent(new Event('error'))
     })
     expect(container.textContent).toContain('Preview not available')
 
-    // An overwrite preserves `file.key` — the parent's key — so only the version
-    // changes and the component never remounts.
-    render({ ...file, updatedAt: new Date('2026-02-01T00:00:00Z') })
+    // Every content write mints a fresh key, so the parent's `key={file.key}`
+    // remounts this and the previous bytes' outcome cannot stick.
+    const overwritten = { ...file, key: 'workspace/ws-1/photo-v2.heic' }
+    act(() => root.render(<ImagePreview key={overwritten.key} file={overwritten} />))
 
     expect(container.querySelector('img')).not.toBeNull()
     expect(container.textContent).not.toContain('Preview not available')

apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/image-preview.tsx

@@ -8,29 +8,19 @@ import { ZoomablePreview } from './zoomable-preview'
 
 export const ImagePreview = memo(function ImagePreview({ file }: { file: WorkspaceFileRecord }) {
   const source = useFileContentSource()
-  // Version the URL on updatedAt: overwrites keep the same storage key, so an unversioned
-  // URL would resolve to a previously cached copy instead of the rewritten bytes.
-  // `preview` lets the server substitute a renderable derivative for a HEIC.
+  /** `v` busts the browser cache across content writes; `preview` lets the server
+   *  substitute a renderable JPEG for a HEIC. */
   const serveUrl = source.buildUrl(file.key, {
     version: Number(new Date(file.updatedAt)) || file.size,
     preview: true,
   })
 
   const [status, setStatus] = useState<'loading' | 'loaded' | 'error'>('loading')
-  const [loadedUrl, setLoadedUrl] = useState(serveUrl)
 
-  // The parent keys this on `file.key`, which an overwrite preserves — only the
-  // version changes. Without this the outcome of the previous bytes would stick,
-  // leaving a replaced image permanently on the unsupported state.
-  if (loadedUrl !== serveUrl) {
-    setLoadedUrl(serveUrl)
-    setStatus('loading')
-  }
-
-  // Covers every way the bytes can turn out unrenderable — a derivative the server
-  // declined to build (too large, undecodable) and a corrupt or truncated image
-  // alike — rather than leaving a broken image in the viewer.
-  if (status === 'error') return <UnsupportedPreview file={file} />
+  /** A derivative the server declined to build, or corrupt bytes — show the download
+   *  fallback rather than a broken image. Content writes mint a new storage key, so
+   *  the parent's `key={file.key}` resets this. */
+  if (status === 'error') return <UnsupportedPreview name={file.name} />
 
   return (
     <div className='relative flex min-h-0 flex-1 flex-col'>

apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/preview-shared.tsx

@@ -13,12 +13,8 @@ const logger = createLogger('FilePreview')
  * viewer at all, or a viewer that was expected to work failed (e.g. a HEIC whose
  * server-side derivative could not be produced).
  */
-export const UnsupportedPreview = memo(function UnsupportedPreview({
-  file,
-}: {
-  file: { name: string }
-}) {
-  const ext = getFileExtension(file.name)
+export const UnsupportedPreview = memo(function UnsupportedPreview({ name }: { name: string }) {
+  const ext = getFileExtension(name)
 
   return (
     <div className='flex flex-1 flex-col items-center justify-center gap-[8px]'>

apps/sim/hooks/use-file-content-source.tsx

@@ -117,7 +117,8 @@ export function createPublicFileContentSource(
   contentUrl: string
 ): FileContentSource {
   return inlineImageSource(
-    (_key, opts) => (opts?.preview ? `${contentUrl}?preview=1` : contentUrl),
+    (_key, opts) =>
+      opts?.preview ? `${contentUrl}${contentUrl.includes('?') ? '&' : '?'}preview=1` : contentUrl,
     `/api/files/public/${token}/inline`
   )
 }

apps/sim/lib/api/contracts/public-shares.ts

@@ -117,7 +117,7 @@ export const getPublicFileContract = defineRouteContract({
 })
 
 const publicFileContentQuerySchema = z.object({
-  /** `1` => the caller is rendering these bytes, not downloading them, so a format no browser decodes (HEIC) may be substituted with a renderable derivative. Absent => the stored bytes are served. */
+  /** `1` => rendering, not downloading — a HEIC may be substituted with a JPEG derivative. */
   preview: z.string().nullish(),
 })
 

apps/sim/lib/api/contracts/storage-transfer.ts

@@ -501,7 +501,7 @@ export const fileServeParamsSchema = z.object({
 
 export const fileServeQuerySchema = z.object({
   raw: z.string().nullish(),
-  /** `1` => the caller is rendering these bytes, not downloading them, so a format no browser decodes (HEIC) may be substituted with a renderable derivative. Absent => the stored bytes are served. */
+  /** `1` => rendering, not downloading — a HEIC may be substituted with a JPEG derivative. */
   preview: z.string().nullish(),
   /** Content version (the file record's `updatedAt`). Present => the URL is content-immutable and may be cached indefinitely by the browser. */
   v: z.string().nullish(),

apps/sim/lib/uploads/server/heic.test.ts

@@ -73,6 +73,17 @@ describe('isHeifContainer', () => {
     expect(isHeifContainer(truncated)).toBe(false)
   })
 
+  it('caps the scan so an inflated declared box size cannot drive the loop', () => {
+    // The declared size is attacker-controlled; without the cap this scans the
+    // whole buffer, and this runs on every preview request.
+    const inflated = Buffer.alloc(64 * 1024)
+    inflated.writeUInt32BE(0xffffffff, 0)
+    inflated.write('ftyp', 4, 'ascii')
+    inflated.write('isom', 8, 'ascii')
+    inflated.write('heic', 60 * 1024, 'ascii')
+    expect(isHeifContainer(inflated)).toBe(false)
+  })
+
   it('rejects buffers too short to carry a brand', () => {
     expect(isHeifContainer(Buffer.alloc(0))).toBe(false)
     expect(isHeifContainer(ftypHeader('heic').subarray(0, 11))).toBe(false)

apps/sim/lib/uploads/server/heic.ts

@@ -30,6 +30,9 @@ const HEIF_BRANDS = new Set([...HEVC_HEIF_BRANDS, 'mif1', 'msf1', 'avif', 'avis'
  */
 const MAX_TRANSCODE_INPUT_BYTES = 20 * 1024 * 1024
 
+/** A real `ftyp` box holds a handful of brands; anything larger is malformed or hostile. */
+const MAX_FTYP_BOX_BYTES = 512
+
 /**
  * Whether an ISO-BMFF `ftyp` box names any of `brands`, as either the major brand
  * or a compatible brand.
@@ -47,8 +50,9 @@ function declaresBrand(buffer: Buffer, brands: ReadonlySet<string>): boolean {
   // the HEIF brand only among the compatible brands, which follow the 4-byte
   // minor_version at offset 12 and run to the end of the box. A declared size of 0
   // or 1 (the ISO-BMFF size escapes, which `ftyp` does not use) leaves `end` below
-  // the loop's start, so those simply do not scan.
-  const end = Math.min(buffer.readUInt32BE(0), buffer.length)
+  // the loop's start, so those simply do not scan. The size is attacker-controlled
+  // and this runs on every preview, so cap it rather than trusting the declaration.
+  const end = Math.min(buffer.readUInt32BE(0), buffer.length, MAX_FTYP_BOX_BYTES)
   for (let offset = 16; offset + 4 <= end; offset += 4) {
     if (brands.has(buffer.toString('ascii', offset, offset + 4))) return true
   }