Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(next): reject protocol-relative URLs in image optimization #65752

Merged
merged 7 commits into from
May 15, 2024
Merged

fix(next): reject protocol-relative URLs in image optimization #65752

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
6a0aa77
fix(next): reject protocol-relative URLs in image optimization
emmerich May 14, 2024
54a03a8
Better error message
emmerich May 14, 2024
f1a9672
Fix test to check for new error message
emmerich May 14, 2024
7a3063b
Merge branch 'canary' into emmerich/fix-protocol-relative-image-optim…
emmerich May 15, 2024
1560201
Merge branch 'canary' into emmerich/fix-protocol-relative-image-optim…
styfle May 15, 2024
339852c
fix test `should fail when internal url is not an image`
styfle May 15, 2024
b9e7042
fix lint
styfle May 15, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions packages/next/src/server/image-optimizer.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -198,6 +198,10 @@ export class ImageOptimizerCache {
return { errorMessage: '"url" parameter is too long' }
}

if (url.startsWith('//')) {
return { errorMessage: '"url" parameter cannot be a protocol-relative URL (//)'}
}

let isAbsolute: boolean

if (url.startsWith('/')) {
Expand Down
7 changes: 7 additions & 0 deletions test/integration/image-optimizer/test/util.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -987,6 +987,13 @@ export function runTests(ctx: RunTestsCtx) {
expect(await res.text()).toBe(`"url" parameter is too long`)
})

it('should fail when url is protocol relative', async () => {
const query = { url: `//example.com`, w: ctx.w, q: 1 }
const res = await fetchViaHTTP(ctx.appPort, '/_next/image', query, {})
expect(res.status).toBe(400)
expect(await res.text()).toBe(`"url" parameter cannot be a protocol-relative URL (//)`)
})

it('should fail when internal url is not an image', async () => {
const url = `//<h1>not-an-image</h1>`
const query = { url, w: ctx.w, q: 39 }
Expand Down
Loading