[Bug]: Issue with realpath

[captenmasin]

What happened?

I'm getting a 404 on a fresh installation with Spatie Media library when accessing an image transform URL

I'm sure it's something I've done wrong but I can't quite figure it out

How to reproduce the bug

I have an image stored at /storage/app/public/29/content.png
With the config set to 'public_path' => env('IMAGE_TRANSFORM_PUBLIC_PATH', 'storage'), as the comment suggests, however going to /image-transform/width=250,quality=80,format=webp,blur=50/29/content.png serves a 404

Diving into the package code and dd'ing
dd(public_path($pathPrefix.'/'.$path), $publicPath);

Gives me

"/Users/mason/Sites/library/public/storage/29/content.png"
"/Users/mason/Sites/library/storage/app/public/29/content.png"

But if I change the line
$publicPath = realpath(public_path($pathPrefix.'/'.$path));
into
$publicPath = public_path($pathPrefix.'/'.$path);

I get

"/Users/mason/Sites/library/public/storage/29/content.png"
"/Users/mason/Sites/library/public/storage/29/content.png"

and it works fine

Package Version

0.4.0

PHP Version

8.4.8

Laravel Version

12.19.3

Which operating systems does this happen with?

macOS

Notes

No response

[ace-of-aces]

Hey @captenmasin, thanks for reporting this issue!

I've checked it out, it's indeed a bug. Removing realpath like you suggested works, but it's insecure.

I've added this check in v0.3.0 in order to protect against potential path traversal attacks through this package (although the regex in the route should catch this, but it's not super safe to rely on).

But yes, turns out this broke compatibility with public storage. We'll actually need to check for file existence in storage_path('app/public'), where the underlying images are stored.

Here's how I plan to fix it:

Check for file existence in the actual underlying path, but just adding exceptions for public_path values like storage/... wouldn't be a clean and reliable approach IMO.

Instead, I'm going to change the configuration approach from the single public_path value to an array, like this:

'allowed_source_directories' => [
    public_path('images'),
    storage_path('app/public'),
],

This will also extend the packages capabilities by allowing you to define multiple source directories.
It will be a breaking change, so you'll need to adjust your config file.

[ace-of-aces]

Alright, so I had to modify the config approach quite a bit 😅

So to fix your issue, you should upgrade to the newly released v0.5.0 and change your config to something like this:

/*
    |--------------------------------------------------------------------------
    | Source Directories
    |--------------------------------------------------------------------------
    |
    | Here you may configure the directories from which the image transformer
    | is allowed to serve images. For security reasons, it is recommended
    | to only allow directories which are already publicly accessible.
    |
    | Important: The public storage directory should be addressed directly via
    | storage('app/public') instead of the public_path('storage') link.
    |
    */

    'source_directories' => [
        'storage' => storage_path('app/public'),
    ],

    /*
    |--------------------------------------------------------------------------
    | Default Source Directory
    |--------------------------------------------------------------------------
    |
    | Below you may configure the default source directory which is used when
    | no specific path prefix is provided in the URL. This should be one of
    | the keys from the source_directories array.
    |
    */

    'default_source_directory' => env('IMAGE_TRANSFORM_DEFAULT_SOURCE_DIRECTORY', 'storage'),

Hope this helps!

[francoism90]

Would it be possible to extend this package with S3? Like getting the image from a S3 storage, and transform it with this package? :)

Thanks for this, it looks really interesting!

[ace-of-aces]

@francoism90 Yeah, I think that should be doable through Laravels File Facade.
I'm not an S3 user myself, so not my top priority right now.

If you want to have this feature, please open a new feature request or submit a PR.