Firefox extension to recontainerize HackerOne WebM files to restore duration and playback controls.
WebM files on HackerOne are broken since their duration isn't set (I suspect because H1 strips its metadata contents). Thus, the total duration of evidence WebMs cannot be seen, which also breaks the playback controls in the embedded video player.
The only available fix is to recontainerize (remux) the WebMs to include their actual duration via ffmpeg, although this process requires downloading the file locally:
ffmpeg -i no-duration.webm -c copy fixed-duration.webmThis Firefox extension leverages the WASM port of ffmpeg to perform the WebM remuxing in-browser, and replaces the broken WebMs with the fixed blobs in the embedded player, thus fixing the duration and implementing playback controls. Additionally, it creates additional download links to the fixed WebMs, in case that they need to be downloaded locally.
As remuxing does not require reencoding any files, the process is almost seamless, without significant performance penalties for the browser. However, since H1 loads its resources dynamically while navigating a report, the extension requires constant monitoring of active H1 tabs to detect any changes to the DOM where a WebM file may have been included. This is the most resource intensive task, although I have not detected a significant performance downgrade in my testing.
The latest packaged release can be downloaded from releases.
The extension .xpi must be installed as a local file from about:addons. It is tentatively signed by Mozilla, although it is not publicly available in the extension marketplace. It will ask for permissions on hackerone.com and amazonaws.com subdomains (since there's where H1 attachments are hosted). No further configuration is involved.
download.js: Creates an observer to monitor the DOM. When it detects a block containing a WebM file, it passes its source toremux.js. After the file comes back from remuxing, it replaces the video source with the remuxed data blob and includes download links to the file in the DOM.remux.js: Imports ffmpeg-wasm components from/assets/and applies"ffmpeg -i", "input.webm", "-c", "copy", "output.webm"to files sent bydownload.js. It works as a background script, and communication withdownload.jsis achieved via sendMessage listener./assets/folder: Contains theffmpeg-wasmvanilla JavaScript implementation, as well as the/assets/core/package/dist/esm/ffmpeg-core.wasmWebAssembly.
- Remux mkv attachments to mp4 in order to allow HTML embedding, since matroska files are not supported in video tags
- Add an Embed button for video attachments not embedded in a report