A user of my free tool uploaded a recording named voice.m4a and got "This doesn't look like a real .m4a file." The file was fine. It was a WebM/Opus recording that had been saved with an .m4a extension. My upload check was wrong, not the user.

This is a short write-up of what I changed, and why file extensions are the wrong thing to trust.

The bug

My converter (Node + ffmpeg) checked the first bytes of an upload against the file's extension:

// before: decide by extension, then check one signature case "m4a" : return head . slice ( 4 , 8 ) . toString ( ) === "ftyp" ;

Enter fullscreen mode

Exit fullscreen mode

Real files are renamed all the time: WebM saved as .m4a , an MP3 named .wav , a screen recording shared as .mp4 .…