Problem
src/lib/ffmpeg.ts generates session IDs to isolate FFmpeg file names:
function buildSessionId(): string {
if (typeof crypto !== "undefined" && "randomUUID" in crypto) {
return crypto.randomUUID();
}
return `${Date.now()}-${Math.random().toString(16).slice(2)}`;
}The fallback path uses Date.now() (millisecond precision) combined with
Math.random(). In environments where crypto.randomUUID is unavailable
(older browsers, certain SSR contexts), two concurrent exports started within
the same millisecond can generate the same session ID. This causes their
temporary FFmpeg files (input_<id>.mp4, output_<id>.mp4) to collide,
leading to one export overwriting the other's input file mid-process.
crypto.randomUUID is available in all modern browsers (Chrome 92+, Firefox
95+, Safari 15.4+). However, the fallback is not secure and not collision-
resistant for concurrent use.
Impact
- In concurrent export scenarios, file name collision causes one export to
read corrupted input data from the other export's file.
- The resulting export produces a corrupted or mismatched output video with
no error message.
Suggested Fix
- Remove the fallback entirely and require
crypto.randomUUID. All browsers
listed in Reframe's support matrix (Chrome 90+, Firefox 89+, Safari 15+)
support crypto.randomUUID.
- If the fallback must stay, use a counter-based approach that guarantees
uniqueness within the session:
let counter = 0;
function buildSessionId(): string {
return `${Date.now()}-${++counter}-${Math.random().toString(36).slice(2)}`;
}
- Add a startup check that throws a clear error if
crypto.randomUUID is
absent rather than silently degrading to a weaker ID scheme.
Problem
src/lib/ffmpeg.tsgenerates session IDs to isolate FFmpeg file names:The fallback path uses
Date.now()(millisecond precision) combined withMath.random(). In environments wherecrypto.randomUUIDis unavailable(older browsers, certain SSR contexts), two concurrent exports started within
the same millisecond can generate the same session ID. This causes their
temporary FFmpeg files (
input_<id>.mp4,output_<id>.mp4) to collide,leading to one export overwriting the other's input file mid-process.
crypto.randomUUIDis available in all modern browsers (Chrome 92+, Firefox95+, Safari 15.4+). However, the fallback is not secure and not collision-
resistant for concurrent use.
Impact
read corrupted input data from the other export's file.
no error message.
Suggested Fix
crypto.randomUUID. All browserslisted in Reframe's support matrix (Chrome 90+, Firefox 89+, Safari 15+)
support
crypto.randomUUID.uniqueness within the session:
crypto.randomUUIDisabsent rather than silently degrading to a weaker ID scheme.