Make cover proxy legal content types configurable. (#3388)

config/vufind/config.ini

@@ -1030,6 +1030,13 @@ coverproxyCache[] = "/assets\.thirdiron\.com/"
 coverproxyAllowedHosts[] = "/assets\.thirdiron\.com$/"
 coverproxyAllowedHosts[] = "/\.summon\.serialssolutions\.com$/"
 
+; This setting controls the content types allowed through the cover proxy.
+; Note that proxying SVG files is not recommended because of their potential for
+; abuse in cross-site scripting attacks.
+coverproxyAllowedTypes[] = "image/gif"
+coverproxyAllowedTypes[] = "image/jpeg"
+coverproxyAllowedTypes[] = "image/png"
+
 ; This setting controls how cover image URLs are loaded. They could be loaded as
 ; part of main request, or asynchronously. Asynchronous loading is disabled by
 ; default; to enable it, just uncomment the line below.

module/VuFind/src/VuFind/Controller/CoverController.php

@@ -33,6 +33,8 @@
 use VuFind\Cover\Loader;
 use VuFind\Session\Settings as SessionSettings;
 
+use function in_array;
+
 /**
  * Generates covers for book entries
  *
@@ -146,6 +148,20 @@ protected function proxyAllowedForUrl(string $url): bool
         return false;
     }
 
+    /**
+     * Is the content type allowed by the cover proxy?
+     *
+     * @param string $contentType Type to check
+     *
+     * @return bool
+     */
+    protected function isValidProxyImageContentType(string $contentType): bool
+    {
+        $validTypes = $this->config['coverproxyAllowedTypes']
+            ?? ['image/gif', 'image/jpeg', 'image/png'];
+        return in_array(strtolower($contentType), array_map('strtolower', $validTypes));
+    }
+
     /**
      * Send image data for display in the view
      *
@@ -161,7 +177,7 @@ public function showAction()
             try {
                 $image = $this->proxy->fetch($url);
                 $contentType = $image?->getHeaders()?->get('content-type')?->getFieldValue() ?? '';
-                if (str_starts_with(strtolower($contentType), 'image/')) {
+                if ($this->isValidProxyImageContentType($contentType)) {
                     return $this->displayImage(
                         $contentType,
                         $image->getContent()