fix(media): ignore inherited prototype keys in the MIME allow-list

lib/media.ts

@@ -25,7 +25,10 @@ const ALLOWED_EXT_TYPES: Record<string, string> = Object.fromEntries(
 
 export function mediaTypeForUpload(name: string | undefined | null, type: string | undefined | null): string | null {
   const mime = String(type || "").trim().toLowerCase();
-  if (ALLOWED_TYPES[mime]) return mime;
+  // Use hasOwn, not a truthy bracket lookup: `ALLOWED_TYPES["constructor"]` /
+  // `["__proto__"]` resolve to inherited Object.prototype members and are truthy,
+  // which would let a crafted Content-Type slip any file past the video allow-list.
+  if (Object.hasOwn(ALLOWED_TYPES, mime)) return mime;
   if (mime && mime !== "application/octet-stream") return null;
 
   const lowerName = String(name || "").toLowerCase();

tests/media-upload-type.test.mjs

@@ -20,3 +20,13 @@ test("media upload type rejects empty or generic non-video names", () => {
   assert.equal(mediaTypeForUpload("payload", "application/octet-stream"), null);
   assert.equal(mediaTypeForUpload("clip.gif", "application/octet-stream"), null);
 });
+
+test("media upload type ignores inherited Object.prototype keys as MIME types", () => {
+  // A crafted Content-Type must not resolve through the prototype chain and
+  // slip a non-video file past the allow-list.
+  assert.equal(mediaTypeForUpload("evil.html", "constructor"), null);
+  assert.equal(mediaTypeForUpload("evil.html", "__proto__"), null);
+  assert.equal(mediaTypeForUpload("evil.exe", "hasOwnProperty"), null);
+  // An explicit non-allowed type is rejected outright, even with a video name.
+  assert.equal(mediaTypeForUpload("clip.mp4", "constructor"), null);
+});