From 3c445415a8fa847805de37b1a4bdcf96f6b0db09 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Knut=20Melv=C3=A6r?= <knut@sanity.io>
Date: Wed, 25 Feb 2026 17:00:45 -0800
Subject: [PATCH] fix(stega): add mux video machine fields to default filter
 denylist

Add 13 machine-generated fields to the stega filterDefault denylist to
prevent encoding invisible characters into values that break rendering
and logic:

- aspect_ratio/aspectRatio: breaks CSS aspect-ratio calculations
- blurHash/thumbHash: machine-generated image placeholder hashes
- encoding_tier, master_access, max_resolution_tier,
  max_stored_resolution, mp4_support, resolution_tier, upload_id,
  video_quality, video_resolution: Mux video API fields

None of these are user-editable content, so filtering them has zero
impact on visual editing functionality.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 src/stega/filterDefault.ts       | 15 ++++++++++++++-
 test/stega/filterDefault.test.ts | 15 ++++++++++++++-
 2 files changed, 28 insertions(+), 2 deletions(-)

diff --git a/src/stega/filterDefault.ts b/src/stega/filterDefault.ts
index 5f85e8331..88f987bc4 100644
--- a/src/stega/filterDefault.ts
+++ b/src/stega/filterDefault.ts
@@ -41,10 +41,14 @@ export const filterDefault: FilterDefault = ({sourcePath, resultPath, value}) =>
 }
 
 const denylist = new Set([
+  'aspect_ratio',
+  'aspectRatio',
+  'blurHash',
   'color',
   'colour',
   'currency',
   'email',
+  'encoding_tier',
   'format',
   'gid',
   'hex',
@@ -61,9 +65,14 @@ const denylist = new Set([
   'linkAction',
   'locale',
   'lqip',
+  'master_access',
+  'max_resolution_tier',
+  'max_stored_resolution',
+  'mp4_support',
   'page',
   'path',
   'ref',
+  'resolution_tier',
   'rgb',
   'rgba',
   'route',
@@ -72,13 +81,17 @@ const denylist = new Set([
   'status',
   'tag',
   'template',
+  'textTheme',
   'theme',
+  'thumbHash',
   'type',
-  'textTheme',
   'unit',
+  'upload_id',
   'url',
   'username',
   'variant',
+  'video_quality',
+  'video_resolution',
   'website',
 ])
 
diff --git a/test/stega/filterDefault.test.ts b/test/stega/filterDefault.test.ts
index d9bab83ec..2f7f0ee2c 100644
--- a/test/stega/filterDefault.test.ts
+++ b/test/stega/filterDefault.test.ts
@@ -275,10 +275,14 @@ describe('filterDefault', () => {
 
   describe('Denylist handling', () => {
     test.each([
+      ['aspect_ratio'],
+      ['aspectRatio'],
+      ['blurHash'],
       ['color'],
       ['colour'],
       ['currency'],
       ['email'],
+      ['encoding_tier'],
       ['format'],
       ['gid'],
       ['hex'],
@@ -295,9 +299,14 @@ describe('filterDefault', () => {
       ['linkAction'],
       ['locale'],
       ['lqip'],
+      ['master_access'],
+      ['max_resolution_tier'],
+      ['max_stored_resolution'],
+      ['mp4_support'],
       ['page'],
       ['path'],
       ['ref'],
+      ['resolution_tier'],
       ['rgb'],
       ['rgba'],
       ['route'],
@@ -306,13 +315,17 @@ describe('filterDefault', () => {
       ['status'],
       ['tag'],
       ['template'],
+      ['textTheme'],
       ['theme'],
+      ['thumbHash'],
       ['type'],
-      ['textTheme'],
       ['unit'],
+      ['upload_id'],
       ['url'],
       ['username'],
       ['variant'],
+      ['video_quality'],
+      ['video_resolution'],
       ['website'],
     ])('should skip encoding denylisted key "%s"', (key) => {
       const result = filterDefault({