Added image type checking, and prevent downloading non images.
We didn't checked this before, which could in turn could allow someone
to download an arbitrary file.
This also prevents SVG images from being used, while they work on the
web-vault and desktop client, they didn't on the mobile versions.
Because of this image type checking we can return a valid file type
instead of only 'x-icon' (which is still used as a fallback).
Prevent rel values with icon-mask, these are not valid favicons.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/dani-garcia/vaultwarden/pull/1583
**Author:** [@BlackDex](https://github.com/BlackDex)
**Created:** 4/3/2021
**Status:** ✅ Merged
**Merged:** 4/6/2021
**Merged by:** [@dani-garcia](https://github.com/dani-garcia)
**Base:** `master` ← **Head:** `icon-updates`
---
### 📝 Commits (1)
- [`1d0eaac`](https://github.com/dani-garcia/vaultwarden/commit/1d0eaac260d251abed23106e6356cb07e5b6e994) Updated icon fetching.
### 📊 Changes
**1 file changed** (+45 additions, -13 deletions)
<details>
<summary>View changed files</summary>
📝 `src/api/icons.rs` (+45 -13)
</details>
### 📄 Description
- Added image type checking, and prevent downloading non images.
We didn't checked this before, which could in turn could allow someone
to download an arbitrary file.
- This also prevents SVG images from being used, while they work on the
web-vault and desktop client, they didn't on the mobile versions.
- Because of this image type checking we can return a valid file type
instead of only 'x-icon' (which is still used as a fallback).
- Prevent rel values with `icon-mask`, these are not valid favicons.
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/dani-garcia/vaultwarden/pull/1583
Author: @BlackDex
Created: 4/3/2021
Status: ✅ Merged
Merged: 4/6/2021
Merged by: @dani-garcia
Base:
master← Head:icon-updates📝 Commits (1)
1d0eaacUpdated icon fetching.📊 Changes
1 file changed (+45 additions, -13 deletions)
View changed files
📝
src/api/icons.rs(+45 -13)📄 Description
We didn't checked this before, which could in turn could allow someone
to download an arbitrary file.
web-vault and desktop client, they didn't on the mobile versions.
instead of only 'x-icon' (which is still used as a fallback).
icon-mask, these are not valid favicons.🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.