fix: validate uploaded media files

zyrarbot/ui/api/routers/uploads_router.py

@@ -1,10 +1,13 @@
 from __future__ import annotations
 
+import shutil
+import tempfile
 from typing import Any
 
 import discord
 from fastapi import APIRouter, Depends, File, HTTPException, UploadFile
 
+from zyrarbot.audio.media_probe import MediaProbe
 from zyrarbot.storage.uploads_repository import UploadsRepository
 from zyrarbot.ui.api.dependencies import get_active_guild, get_uploads
 
@@ -25,8 +28,22 @@ async def upload(
     guild: discord.Guild = Depends(get_active_guild),
     uploads: UploadsRepository = Depends(get_uploads),
 ) -> dict[str, str]:
+    filename = file.filename or ""
+    if not uploads.is_supported_filename(filename):
+        raise HTTPException(
+            status_code=415,
+            detail="Unsupported file type. Upload an audio or video file.",
+        )
+
+    suffix = filename[filename.rfind(".") :]
+    with tempfile.NamedTemporaryFile(suffix=suffix) as temporary:
+        shutil.copyfileobj(file.file, temporary)
+        temporary.flush()
+        if not await MediaProbe().is_media(temporary.name):
+            raise HTTPException(status_code=415, detail="The uploaded file is not valid media")
+    file.file.seek(0)
     try:
-        filename = uploads.save(file.filename or "plik", file.file, guild.id)
+        filename = uploads.save(filename, file.file, guild.id)
     except OSError as error:
         raise HTTPException(status_code=500, detail=f"Błąd zapisu pliku: {error}") from error
     return {"status": "success", "filename": filename}