Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

thumbs: the image fetch has no private-host, scheme, body-size or converter-time limits, and no workflow has a job timeout

オープン
  • 何か問題がありますか？
#134 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
4/5
見積もり時間
3〜5日
初心者へのやさしさ
55/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
github-actions, javascript, node.js
領域
backend, ci-cd, security

調査の方向性

Start with site/lib/thumbs.mjs, site/checks.mjs, and the thumbs.yml and links.yml workflows. Trace image URL validation, redirects, body reading, and the ffmpeg call, then check how workflow jobs are declared. Done means the private-host, size-cap, converter-timeout, and workflow-timeout cases in the issue are handled; the issue does not name tests, so identify or add focused fixtures for those cases.

索引モデルが issue の本文から書いたものです。

説明

hardening priority: medium

Why it matters

site/thumbs.mjs runs monthly on an Actions runner with contents: write and follows whatever a third-party page's og:image says. A broken or hostile publisher page can make it request internal addresses, buffer an unbounded body in memory, or leave ffmpeg running until the job's 6-hour default timeout. None of this reaches the deployed site (a bad image is still just a resized image), so this is hardening rather than a vulnerability, and each item is a small fix.

Evidence (at 69387df)

  • site/lib/thumbs.mjs:93-95 accepts any http:/https: host; an og:image pointing at a loopback address is returned as a valid URL. validate guards entry URLs with isPrivateHost (site/checks.mjs:651, 671) but thumbs.mjs and checkPreviewField (checks.mjs:787-792) do not reuse it.
  • Plain-http images are fetched and stored: adventure-kid-irs, eric-skiff-resistor-anthems, synfig in site/thumbs.json.
  • site/thumbs.mjs:99-107 reads the whole body (await res.arrayBuffer()) before comparing to MAX_IMAGE_BYTES; content-length is optional and unverified.
  • site/thumbs.mjs:87-97 calls execFileSync("ffmpeg", ...) with no timeout and no maxBuffer.
  • No timeout-minutes on any job in .github/workflows/*.yml.

Suggested approach

Move isPrivateHost into site/lib/ and apply it to the og:image URL, to preview: in checkPreviewField, and to the final res.url after redirects. Reject http: images or upgrade to https: and fall back only when the upgrade fails. Stream the body with a byte cap, aborting past MAX_IMAGE_BYTES. Pass { timeout: 30_000, killSignal: "SIGKILL" } to execFileSync, and sniff the first bytes for PNG/JPEG/GIF/WebP magic before invoking the converter. Add timeout-minutes: 30 to thumbs.yml and links.yml, and a smaller value to the others.

Done when

A fixture with a private og:image is reported as "skipped: private host"; a fetch that exceeds the cap aborts without buffering; a converter hang ends with "convert failed: timed out"; every workflow job has a timeout.

主要言語
JavaScript
スター
58
フォーク
15
平均マージ
16時間 53分
マージ済み PR（30日）
14

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

TMHSDigital/Free-Game-Dev-Assets のほかの issue

TMHSDigital/Free-Game-Dev-Assets の issue をすべて見る

似ている issue

JavaScript の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。