chunkSize) { chunks.push(await file.slice(Math.max(0, file.size - chunkSize), file.size).arrayBuffer()); } var decoder = new TextDecoder('iso-8859-1'); for (var i = 0; i < chunks.length; i++) { var text = decoder.decode(new Uint8Array(chunks[i])).toLowerCase(); for (var j = 0; j < MALICIOUS_PATTERNS.length; j++) { if (text.indexOf(MALICIOUS_PATTERNS[j]) !== -1) { return MALICIOUS_PATTERNS[j]; } } } return null; } function verifyRealImageDimensions(file) { return new Promise(function(resolve) { var url = URL.createObjectURL(file); var img = new Image(); img.setAttribute('data-no-fallback', 'true'); var done = function(ok) { URL.revokeObjectURL(url); resolve(ok); }; img.onload = function() { done(img.naturalWidth > 0 && img.naturalHeight > 0 && img.naturalWidth <= 12000 && img.naturalHeight <= 12000); }; img.onerror = function() { done(false); }; img.src = url; }); } async function inspectImageFile(file) { if (!file || !(file instanceof File)) { return { valid: false, reason: 'File tidak valid.' }; } var name = (file.name || '').trim(); if (!name || FORBIDDEN_DBL_EXT.test(name)) { return { valid: false, reason: 'Keamanan Upload: Nama atau ekstensi file terdeteksi berbahaya (ekstensi ganda/script tidak diizinkan).' }; } if (!ALLOWED_IMG_EXT.test(name)) { return { valid: false, reason: 'Keamanan Upload: Ekstensi file harus berupa gambar asli (.jpg, .jpeg, .png, .webp, .gif, .bmp, .avif).' }; } if (file.size < 12) { return { valid: false, reason: 'Keamanan Upload: File gambar kosong atau rusak.' }; } try { var headerBuf = await file.slice(0, 16).arrayBuffer(); var headerBytes = new Uint8Array(headerBuf); var detectedFormat = detectImageMagicBytes(headerBytes); if (!detectedFormat) { return { valid: false, reason: 'Keamanan Upload: File ditolak! Hanya namanya saja yang berekstensi gambar, tetapi isi biner aslinya bukan gambar (Magic Bytes tidak valid).' }; } var badToken = await scanForMaliciousCode(file); if (badToken) { return { valid: false, reason: 'Keamanan Upload: File ditolak! Terdeteksi sisipan struktur kode berbahaya di dalam file gambar.' }; } var canDecode = await verifyRealImageDimensions(file); if (!canDecode) { return { valid: false, reason: 'Keamanan Upload: File ditolak karena struktur piksel gambar rusak atau palsu.' }; } return { valid: true, format: detectedFormat }; } catch (err) { return { valid: false, reason: 'Keamanan Upload: Gagal memverifikasi keaslian biner gambar.' }; } } async function inspectVideoFile(file) { if (!file || !(file instanceof File)) { return { valid: false, reason: 'File video tidak valid.' }; } var name = (file.name || '').trim(); if (!name || FORBIDDEN_DBL_EXT.test(name) || !ALLOWED_VID_EXT.test(name)) { return { valid: false, reason: 'Keamanan Upload: File video harus berekstensi asli (.mp4, .webm, .ogg, .mov) tanpa ekstensi script.' }; } try { var headerBuf = await file.slice(0, 16).arrayBuffer(); var headerBytes = new Uint8Array(headerBuf); if (!detectVideoMagicBytes(headerBytes)) { return { valid: false, reason: 'Keamanan Upload: File video ditolak karena struktur biner aslinya bukan file video.' }; } var badToken = await scanForMaliciousCode(file); if (badToken) { return { valid: false, reason: 'Keamanan Upload: File video ditolak karena mengandung sisipan kode berbahaya.' }; } return { valid: true }; } catch (err) { return { valid: false, reason: 'Keamanan Upload: Gagal memverifikasi struktur biner video.' }; } } window.FinzUploadGuard = { inspectImageFile: inspectImageFile, inspectVideoFile: inspectVideoFile, notifyBlocked: notifyBlocked }; // Global Capturing Interceptor for ALL tags across the application document.addEventListener('change', function(e) { var input = e.target; if (!input || input.tagName !== 'INPUT' || input.type !== 'file') return; if (input.dataset.finzVerified === '1') { delete input.dataset.finzVerified; return; } var files = input.files ? Array.from(input.files) : []; if (files.length === 0) return; var accept = (input.getAttribute('accept') || '').toLowerCase(); var isVideoInput = accept.indexOf('video/') !== -1 && accept.indexOf('image/') === -1; // Pause propagation until binary Magic Bytes & payload inspection completes e.stopImmediatePropagation(); (async function() { for (var i = 0; i < files.length; i++) { var res = isVideoInput ? await inspectVideoFile(files[i]) : await inspectImageFile(files[i]); if (!res.valid) { input.value = ''; notifyBlocked(res.reason); return; } } input.dataset.finzVerified = '1'; input.dispatchEvent(new Event('change', { bubbles: true })); })(); }, true); })();
D***** baru saja order
Farming Coin & Unlock Ability