mirror of
https://github.com/go-vikunja/vikunja.git
synced 2026-11-09 00:22:38 -06:00
kolaente
40d95182fc
Decoding now validates image dimensions before allocating pixels (imaging.Fit replaces unbounded Resize so neither side can blow up), backgrounds decode once and reuse the image for the blur hash, and DownloadImage is bounded at the configured max file size. Small sources now keep their native size (Fit does not upscale); the frontend scales via CSS.
51 lines
1.6 KiB
Go
51 lines
1.6 KiB
Go
// Vikunja is a to-do list application to facilitate your life.
|
|
// Copyright 2018-present Vikunja and contributors. All rights reserved.
|
|
//
|
|
// This program is free software: you can redistribute it and/or modify
|
|
// it under the terms of the GNU Affero General Public License as published by
|
|
// the Free Software Foundation, either version 3 of the License, or
|
|
// (at your option) any later version.
|
|
//
|
|
// This program is distributed in the hope that it will be useful,
|
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
// GNU Affero General Public License for more details.
|
|
//
|
|
// You should have received a copy of the GNU Affero General Public License
|
|
// along with this program. If not, see <https://www.gnu.org/licenses/>.
|
|
|
|
package imageutils
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
"net/http"
|
|
|
|
"code.vikunja.io/api/pkg/web"
|
|
)
|
|
|
|
// ErrImageTooLarge rejects hostile dimensions before decoding (GHSA-4vh2-39rq-rq8j).
|
|
type ErrImageTooLarge struct {
|
|
Width int
|
|
Height int
|
|
}
|
|
|
|
func (err *ErrImageTooLarge) Error() string {
|
|
return fmt.Sprintf("image dimensions %dx%d are invalid or exceed the maximum of %d pixels", err.Width, err.Height, MaxPixels)
|
|
}
|
|
|
|
const ErrCodeImageTooLarge = 4032
|
|
|
|
func (err *ErrImageTooLarge) HTTPError() web.HTTPError {
|
|
return web.HTTPError{
|
|
HTTPCode: http.StatusBadRequest,
|
|
Code: ErrCodeImageTooLarge,
|
|
Message: fmt.Sprintf("Image dimensions %dx%d are invalid or exceed the maximum of %d pixels.", err.Width, err.Height, MaxPixels),
|
|
}
|
|
}
|
|
|
|
func IsErrImageTooLarge(err error) bool {
|
|
var e *ErrImageTooLarge
|
|
return errors.As(err, &e)
|
|
}
|