Delegate Content-Type verification solely to contentTypeMatches() #252
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Some customer-proxied files have been hosted on servers that will kick back errors if we a) provide a list of Accept'ed Content-Types, or b) provide a Content-Type in the Accept list that the server does not know about.
Some financial institutions will return an error via text/html if a request is made without an Accept-Language header.
Codecov Report
@@ Coverage Diff @@
## main #252 +/- ##
=======================================
Coverage 87.27% 87.27%
=======================================
Files 6 6
Lines 503 503
=======================================
Hits 439 439
Misses 36 36
Partials 28 28
Continue to review full report at Codecov.
|
|
Whoops, forgot that there was a PR for this branch. I'll pull that last commit into a different branch -- we're just disabling SVG all together since we can't properly sanitize it and security researchers keep using it to submit reports. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Image content returned from the initial request will have its
Content-Typeverified at https://github.com/willnorris/imageproxy/blob/main/imageproxy.go#L243. Prefilling theAcceptheader with the list of acceptedContent-Type's has proven troublesome for some of our customers as some web servers have odd behaviors like:Content-Types inAcceptContent-TypeinAcceptthat the server does not know about (likeimage, which is not valid normally, but some web servers return content using that Content-Type 🙃)The addition of
Accept-Languageis similar -- we've found some servers that will return an error if noAccept-Languageheader is supplied. Wack a mole!