Build ErsatzTV Image / Docs update reminder (pull_request) Successful in 5s
Build ErsatzTV Image / Build & test (.NET) (pull_request) Successful in 8m33s
Build ErsatzTV Image / EF migration integrity (SQLite + MySql) (pull_request) Successful in 10m40s
Build ErsatzTV Image / Build & push image (amd64) (pull_request) Has been skipped
S4 stored-XSS + S9 upload-size DoS from the #197 cold API review. The artwork path trusted client-supplied content types at both ends: upload validated only the declared multipart Content-Type (never decoded the bytes), and serving reflected a client `?contentType=` straight into the response Content-Type on unauthenticated GET sinks (/iptv/logos, /artwork/watermarks). Chain: upload <script> bytes as image/png -> GET ...?contentType=text/html serves them as HTML in-origin. nosniff (#279) does not help because the server explicitly declares text/html. - Upload: derive the content type from the bytes via SkiaSharp SKCodec (header-only, no decode -> no decompression-bomb path); reject non-images 422. New ErsatzTV.Core/Images/ImageContentTypes as the single allow-list source. Dropped the untrusted declared Content-Type from the UploadArtwork command. - Serve: removed the ?contentType= reflection structurally -- dropped ContentType from GetCachedImagePath and the [FromQuery] binding on GetImage/GetWatermark; the handler always sniffs the file, defaulting application/octet-stream. ArtworkContentTypeModel.UrlWithContentType is now the bare path; SPA previews no longer append the query. - Defense-in-depth: channel-logo / watermark {path, contentType} DTOs run through ArtworkContentTypeModel.Sanitized(), blanking non-allow-listed types on write. - S9: Kestrel MaxRequestBodySize from ETV_MAXIMUM_UPLOAD_MB rejects oversized bodies during read (controller file.Length check kept as friendly-error backstop). Both serve sinks are IgnoreApi, so no OpenAPI change. Tests: byte-sniff accept/ reject, Sanitized() allow-list, Location no longer carries ?contentType=. Docs: api-conventions §4a + decisions.md 2026-07-12. Refs #283 #197 #66 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
120 lines
4.5 KiB
C#
120 lines
4.5 KiB
C#
using CliWrap;
|
|
using ErsatzTV.Core;
|
|
using ErsatzTV.Core.Domain;
|
|
using ErsatzTV.Core.Interfaces.FFmpeg;
|
|
using ErsatzTV.Core.Interfaces.Images;
|
|
using ErsatzTV.Core.Interfaces.Repositories;
|
|
using Winista.Mime;
|
|
|
|
namespace ErsatzTV.Application.Images;
|
|
|
|
public class
|
|
GetCachedImagePathHandler : IRequestHandler<GetCachedImagePath, Either<BaseError, CachedImagePathViewModel>>
|
|
{
|
|
private static readonly MimeTypes MimeTypes = new();
|
|
private readonly IConfigElementRepository _configElementRepository;
|
|
private readonly IFFmpegProcessService _ffmpegProcessService;
|
|
private readonly IImageCache _imageCache;
|
|
|
|
public GetCachedImagePathHandler(
|
|
IImageCache imageCache,
|
|
IFFmpegProcessService ffmpegProcessService,
|
|
IConfigElementRepository configElementRepository)
|
|
{
|
|
_imageCache = imageCache;
|
|
_ffmpegProcessService = ffmpegProcessService;
|
|
_configElementRepository = configElementRepository;
|
|
}
|
|
|
|
public async Task<Either<BaseError, CachedImagePathViewModel>> Handle(
|
|
GetCachedImagePath request,
|
|
CancellationToken cancellationToken)
|
|
{
|
|
Validation<BaseError, string> validation = await Validate(cancellationToken);
|
|
return await validation.Match(
|
|
ffmpegPath => Handle(ffmpegPath, request, cancellationToken),
|
|
error => Task.FromResult<Either<BaseError, CachedImagePathViewModel>>(error.Join()));
|
|
}
|
|
|
|
private async Task<Either<BaseError, CachedImagePathViewModel>> Handle(
|
|
string ffmpegPath,
|
|
GetCachedImagePath request,
|
|
CancellationToken cancellationToken)
|
|
{
|
|
try
|
|
{
|
|
string mimeType;
|
|
|
|
string cachePath = _imageCache.GetPathForImage(
|
|
request.FileName,
|
|
request.ArtworkKind,
|
|
Optional(request.MaxHeight));
|
|
|
|
if (cachePath == null)
|
|
{
|
|
return BaseError.New("Failed to generate cache path for image");
|
|
}
|
|
|
|
if (!File.Exists(cachePath))
|
|
{
|
|
if (request.MaxHeight.HasValue)
|
|
{
|
|
string baseFolder = Path.GetDirectoryName(cachePath);
|
|
if (baseFolder != null && !Directory.Exists(baseFolder))
|
|
{
|
|
Directory.CreateDirectory(baseFolder);
|
|
}
|
|
|
|
// ffmpeg needs the extension to determine the output codec
|
|
string withExtension = cachePath + ".jpg";
|
|
|
|
string originalPath = _imageCache.GetPathForImage(request.FileName, request.ArtworkKind, None);
|
|
|
|
Command process = await _ffmpegProcessService.ResizeImage(
|
|
ffmpegPath,
|
|
originalPath,
|
|
withExtension,
|
|
request.MaxHeight.Value,
|
|
cancellationToken);
|
|
|
|
CommandResult resize = await process.ExecuteAsync(cancellationToken);
|
|
|
|
if (resize.ExitCode != 0)
|
|
{
|
|
return BaseError.New($"Failed to resize image; exit code {resize.ExitCode}");
|
|
}
|
|
|
|
File.Move(withExtension, cachePath);
|
|
|
|
mimeType = "image/jpeg";
|
|
}
|
|
else
|
|
{
|
|
return BaseError.New($"Artwork does not exist on disk at {cachePath}");
|
|
}
|
|
}
|
|
else
|
|
{
|
|
// Always derive the type from the stored file — never from a client-supplied value
|
|
// (issue #283 — the old ?contentType= reflection was the stored-XSS sink). Fall back
|
|
// to a non-renderable default if the sniffer can't identify the bytes.
|
|
mimeType = MimeTypes.GetMimeTypeFromFile(cachePath)?.Name ?? "application/octet-stream";
|
|
}
|
|
|
|
return new CachedImagePathViewModel(cachePath, mimeType);
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
return BaseError.New(ex.Message);
|
|
}
|
|
}
|
|
|
|
private async Task<Validation<BaseError, string>> Validate(CancellationToken cancellationToken) =>
|
|
await ValidateFFmpegPath(cancellationToken);
|
|
|
|
private Task<Validation<BaseError, string>> ValidateFFmpegPath(CancellationToken cancellationToken) =>
|
|
_configElementRepository.GetValue<string>(ConfigElementKey.FFmpegPath, cancellationToken)
|
|
.FilterT(File.Exists)
|
|
.Map(ffmpegPath => ffmpegPath.ToValidation<BaseError>("FFmpeg path does not exist on the file system"));
|
|
}
|