fix(jimpURL): validate Content-Type before passing to Jimp
Browse filesSome servers ignore the Accept header and return unsupported formats
(e.g. image/avif). Check the actual Content-Type response header and
reject non-Jimp formats with a clear error message before decoding.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
src/ink-picture/utils/jimpURL.ts
CHANGED
|
@@ -1,15 +1,34 @@
|
|
| 1 |
-
|
| 2 |
-
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 3 |
const response = await fetch(url, {
|
| 4 |
headers: {
|
| 5 |
-
|
| 6 |
-
}
|
| 7 |
});
|
| 8 |
|
| 9 |
if (!response.ok) {
|
| 10 |
throw new Error(`Failed to fetch: ${response.status}`);
|
| 11 |
}
|
| 12 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 13 |
const arrayBuffer = await response.arrayBuffer();
|
| 14 |
const buffer = Buffer.from(arrayBuffer);
|
| 15 |
|
|
|
|
| 1 |
+
import { Jimp } from "jimp";
|
| 2 |
+
|
| 3 |
+
const SUPPORTED_MIME_TYPES = new Set([
|
| 4 |
+
"image/jpeg",
|
| 5 |
+
"image/png",
|
| 6 |
+
"image/gif",
|
| 7 |
+
"image/bmp",
|
| 8 |
+
"image/tiff",
|
| 9 |
+
"image/webp",
|
| 10 |
+
]);
|
| 11 |
+
|
| 12 |
+
export async function loadImageFromUrl(url: string) {
|
| 13 |
const response = await fetch(url, {
|
| 14 |
headers: {
|
| 15 |
+
Accept: "image/jpeg, image/png, image/gif, image/bmp, image/tiff, image/webp, */*",
|
| 16 |
+
},
|
| 17 |
});
|
| 18 |
|
| 19 |
if (!response.ok) {
|
| 20 |
throw new Error(`Failed to fetch: ${response.status}`);
|
| 21 |
}
|
| 22 |
|
| 23 |
+
const contentType = response.headers.get("Content-Type") ?? "";
|
| 24 |
+
const mime = contentType.split(";")[0].trim().toLowerCase();
|
| 25 |
+
|
| 26 |
+
if (mime && !SUPPORTED_MIME_TYPES.has(mime)) {
|
| 27 |
+
throw new Error(
|
| 28 |
+
`Unsupported image format: ${mime}. Supported: ${[...SUPPORTED_MIME_TYPES].join(", ")}`,
|
| 29 |
+
);
|
| 30 |
+
}
|
| 31 |
+
|
| 32 |
const arrayBuffer = await response.arrayBuffer();
|
| 33 |
const buffer = Buffer.from(arrayBuffer);
|
| 34 |
|