Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

thumbs: the image fetch has no private-host, scheme, body-size or converter-time limits, and no workflow has a job timeout

Chiusa
  • Qualcosa non va?
#134 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
55/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
github-actions, javascript, node.js
Ambito
backend, ci-cd, security

Direzione di ricerca

Start with site/lib/thumbs.mjs, site/checks.mjs, and the thumbs.yml and links.yml workflows. Trace image URL validation, redirects, body reading, and the ffmpeg call, then check how workflow jobs are declared. Done means the private-host, size-cap, converter-timeout, and workflow-timeout cases in the issue are handled; the issue does not name tests, so identify or add focused fixtures for those cases.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

hardening priority: medium

Why it matters

site/thumbs.mjs runs monthly on an Actions runner with contents: write and follows whatever a third-party page's og:image says. A broken or hostile publisher page can make it request internal addresses, buffer an unbounded body in memory, or leave ffmpeg running until the job's 6-hour default timeout. None of this reaches the deployed site (a bad image is still just a resized image), so this is hardening rather than a vulnerability, and each item is a small fix.

Evidence (at 69387df)

  • site/lib/thumbs.mjs:93-95 accepts any http:/https: host; an og:image pointing at a loopback address is returned as a valid URL. validate guards entry URLs with isPrivateHost (site/checks.mjs:651, 671) but thumbs.mjs and checkPreviewField (checks.mjs:787-792) do not reuse it.
  • Plain-http images are fetched and stored: adventure-kid-irs, eric-skiff-resistor-anthems, synfig in site/thumbs.json.
  • site/thumbs.mjs:99-107 reads the whole body (await res.arrayBuffer()) before comparing to MAX_IMAGE_BYTES; content-length is optional and unverified.
  • site/thumbs.mjs:87-97 calls execFileSync("ffmpeg", ...) with no timeout and no maxBuffer.
  • No timeout-minutes on any job in .github/workflows/*.yml.

Suggested approach

Move isPrivateHost into site/lib/ and apply it to the og:image URL, to preview: in checkPreviewField, and to the final res.url after redirects. Reject http: images or upgrade to https: and fall back only when the upgrade fails. Stream the body with a byte cap, aborting past MAX_IMAGE_BYTES. Pass { timeout: 30_000, killSignal: "SIGKILL" } to execFileSync, and sniff the first bytes for PNG/JPEG/GIF/WebP magic before invoking the converter. Add timeout-minutes: 30 to thumbs.yml and links.yml, and a smaller value to the others.

Done when

A fixture with a private og:image is reported as "skipped: private host"; a fetch that exceeds the cap aborts without buffering; a converter hang ends with "convert failed: timed out"; every workflow job has a timeout.

Lingua principale
JavaScript
Stelle
58
Fork
15
Merge medio
16h 53m
PR unite (30g)
14

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di TMHSDigital/Free-Game-Dev-Assets

Tutte le issue di TMHSDigital/Free-Game-Dev-Assets

Issue simili

Altre issue su JavaScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.