Hacktoberfest 2026: die Issues, die Maintainer für den Oktober markiert haben – offen und einsteigerfreundlich. Hacktoberfest-Issues durchsuchen

thumbs: the image fetch has no private-host, scheme, body-size or converter-time limits, and no workflow has a job timeout

Geschlossen
  • Stimmt etwas nicht?
#134 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
4/5
Geschätzter Aufwand
3-5 Tage
Anfängerfreundlichkeit
55/100
Issue-Typ
Bug
Klarheit
Klar beschrieben
Aktivitätsstatus
Aktiv
Tech-Stack
github-actions, javascript, node.js
Bereich
backend, ci-cd, security

Rechercherichtung

Start with site/lib/thumbs.mjs, site/checks.mjs, and the thumbs.yml and links.yml workflows. Trace image URL validation, redirects, body reading, and the ffmpeg call, then check how workflow jobs are declared. Done means the private-host, size-cap, converter-timeout, and workflow-timeout cases in the issue are handled; the issue does not name tests, so identify or add focused fixtures for those cases.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

hardening priority: medium

Why it matters

site/thumbs.mjs runs monthly on an Actions runner with contents: write and follows whatever a third-party page's og:image says. A broken or hostile publisher page can make it request internal addresses, buffer an unbounded body in memory, or leave ffmpeg running until the job's 6-hour default timeout. None of this reaches the deployed site (a bad image is still just a resized image), so this is hardening rather than a vulnerability, and each item is a small fix.

Evidence (at 69387df)

  • site/lib/thumbs.mjs:93-95 accepts any http:/https: host; an og:image pointing at a loopback address is returned as a valid URL. validate guards entry URLs with isPrivateHost (site/checks.mjs:651, 671) but thumbs.mjs and checkPreviewField (checks.mjs:787-792) do not reuse it.
  • Plain-http images are fetched and stored: adventure-kid-irs, eric-skiff-resistor-anthems, synfig in site/thumbs.json.
  • site/thumbs.mjs:99-107 reads the whole body (await res.arrayBuffer()) before comparing to MAX_IMAGE_BYTES; content-length is optional and unverified.
  • site/thumbs.mjs:87-97 calls execFileSync("ffmpeg", ...) with no timeout and no maxBuffer.
  • No timeout-minutes on any job in .github/workflows/*.yml.

Suggested approach

Move isPrivateHost into site/lib/ and apply it to the og:image URL, to preview: in checkPreviewField, and to the final res.url after redirects. Reject http: images or upgrade to https: and fall back only when the upgrade fails. Stream the body with a byte cap, aborting past MAX_IMAGE_BYTES. Pass { timeout: 30_000, killSignal: "SIGKILL" } to execFileSync, and sniff the first bytes for PNG/JPEG/GIF/WebP magic before invoking the converter. Add timeout-minutes: 30 to thumbs.yml and links.yml, and a smaller value to the others.

Done when

A fixture with a private og:image is reported as "skipped: private host"; a fetch that exceeds the cap aborts without buffering; a converter hang ends with "convert failed: timed out"; every workflow job has a timeout.

Vorherrschende Sprache
JavaScript
Sterne
58
Forks
15
Ø Merge
16 Std. 53 Min.
Gemergte PRs (30 T.)
14

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus TMHSDigital/Free-Game-Dev-Assets

Alle Issues in TMHSDigital/Free-Game-Dev-Assets

Ähnliche Issues

Weitere Issues zu JavaScript

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.