Hacktoberfest 2026 : les issues que les mainteneurs ont marquées pour octobre, ouvertes et accessibles aux débutants. Parcourir les issues Hacktoberfest

thumbs: the image fetch has no private-host, scheme, body-size or converter-time limits, and no workflow has a job timeout

Ouverte
  • Quelque chose ne va pas ?
#134 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

Personne n'a encore pris cette issue.

Évaluation

Difficulté
4/5
Temps estimé
3-5 jours
Accessibilité débutants
55/100
Type d'issue
Bug
Clarté
Clairement spécifiée
Activité
Active
Stack technique
github-actions, javascript, node.js
Domaine
backend, ci-cd, security

Piste de recherche

Start with site/lib/thumbs.mjs, site/checks.mjs, and the thumbs.yml and links.yml workflows. Trace image URL validation, redirects, body reading, and the ffmpeg call, then check how workflow jobs are declared. Done means the private-host, size-cap, converter-timeout, and workflow-timeout cases in the issue are handled; the issue does not name tests, so identify or add focused fixtures for those cases.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

hardening priority: medium

Why it matters

site/thumbs.mjs runs monthly on an Actions runner with contents: write and follows whatever a third-party page's og:image says. A broken or hostile publisher page can make it request internal addresses, buffer an unbounded body in memory, or leave ffmpeg running until the job's 6-hour default timeout. None of this reaches the deployed site (a bad image is still just a resized image), so this is hardening rather than a vulnerability, and each item is a small fix.

Evidence (at 69387df)

  • site/lib/thumbs.mjs:93-95 accepts any http:/https: host; an og:image pointing at a loopback address is returned as a valid URL. validate guards entry URLs with isPrivateHost (site/checks.mjs:651, 671) but thumbs.mjs and checkPreviewField (checks.mjs:787-792) do not reuse it.
  • Plain-http images are fetched and stored: adventure-kid-irs, eric-skiff-resistor-anthems, synfig in site/thumbs.json.
  • site/thumbs.mjs:99-107 reads the whole body (await res.arrayBuffer()) before comparing to MAX_IMAGE_BYTES; content-length is optional and unverified.
  • site/thumbs.mjs:87-97 calls execFileSync("ffmpeg", ...) with no timeout and no maxBuffer.
  • No timeout-minutes on any job in .github/workflows/*.yml.

Suggested approach

Move isPrivateHost into site/lib/ and apply it to the og:image URL, to preview: in checkPreviewField, and to the final res.url after redirects. Reject http: images or upgrade to https: and fall back only when the upgrade fails. Stream the body with a byte cap, aborting past MAX_IMAGE_BYTES. Pass { timeout: 30_000, killSignal: "SIGKILL" } to execFileSync, and sniff the first bytes for PNG/JPEG/GIF/WebP magic before invoking the converter. Add timeout-minutes: 30 to thumbs.yml and links.yml, and a smaller value to the others.

Done when

A fixture with a private og:image is reported as "skipped: private host"; a fetch that exceeds the cap aborts without buffering; a converter hang ends with "convert failed: timed out"; every workflow job has a timeout.

Langage dominant
JavaScript
Étoiles
58
Forks
15
Merge moyen
16 h 53 min
PR mergées (30 j)
14

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de TMHSDigital/Free-Game-Dev-Assets

Toutes les issues de TMHSDigital/Free-Game-Dev-Assets

Issues similaires

Plus d'issues JavaScript

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.