fix: validate social preview metadata

src/content/metadata.ts

@@ -66,6 +66,13 @@ export interface StaticHostArtifacts {
   redirects: string;
 }
 
+const socialPreviewMediaTypes = new Set([
+  'image/avif',
+  'image/jpeg',
+  'image/png',
+  'image/webp',
+]);
+
 const absoluteAssetUrl = (
   assetId: string | undefined,
   manifest: Readonly<PublicAssetManifest>,
@@ -74,6 +81,10 @@ const absoluteAssetUrl = (
   if (assetId === undefined) return undefined;
   const asset = manifest.assets.find((candidate) => candidate.id === assetId);
   if (asset === undefined) throw new Error(`Unknown social preview asset: ${assetId}`);
+  if (!socialPreviewMediaTypes.has(asset.mediaType) ||
+    asset.width !== 1200 || asset.height !== 630 || asset.durationMs !== null) {
+    return undefined;
+  }
   return new URL(`/assets/${encodeURIComponent(asset.fileName)}`, canonicalUrl).href;
 };