Local image transformations fail for filenames containing @
Maintainers usually reply within 1 day
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 62/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- docker, typescript
- Domain
- backend
Research direction
Start in ImageRenderer.getAsset(), where local:// URLs skip the encoding applied to remote sources, and compare with the URL FileBackend.privateAssetUrl() returns. Check the imgproxy plain-URL parsing the issue links (options/url.go, v3.26.0) to see why an unescaped @ is read as a format separator. Reproduce by uploading [email protected] through the file backend and requesting a transformation. Done when that request returns HTTP 200 and the cat.png control still renders.
Written by the indexing model from the issue text.
Description
Bug report
Self-hosted Storage using the file backend cannot transform images with @ in their names, such as [email protected]. This character is accepted by Storage's object-key validation.
FileBackend.privateAssetUrl() returns a raw local:///... source URL. ImageRenderer.getAsset() exempts these local URLs from the encoding applied to remote source URLs. In imgproxy's plain URL syntax, an unescaped @ separates the source URL from the output format. The filename is therefore parsed as a format option.
Reproduction
At Storage master 9d15cdc93c0b1afc37708914f5e45f865b231d48, use the file backend with the bundled darthsim/imgproxy:v3.26.0, upload a PNG as [email protected], then request an image transformation.
A focused reproduction invoking the actual ImageRenderer.getAsset() against that imgproxy image fails with Invalid image request. Imgproxy logs Invalid image format: 2x.png. As a control, the same PNG named cat.png renders successfully. Sending the source URL through encodeURIComponent() also makes the @2x image render successfully (HTTP 200, image/png).
Expected behavior is successful rendering for the accepted filename.
The parser splits on @ before percent decoding: https://github.com/imgproxy/imgproxy/blob/v3.26.0/options/url.go#L50-L72
Scope
The reproduction concerns the local file backend. Remote source URLs already receive the required outer encoding. Filenames containing ? have a separate imgproxy limitation and are outside this report.
Discovered with AI-assisted code inspection and confirmed with a local runtime reproduction.
- Dominant language
- TypeScript
- Stars
- 1.3k
- Forks
- 318
- Avg merge
- 1d 15h
- Merged PRs (30d)
- 104
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from supabase/storage
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day
-
Difficulty 1/5 1-3 hours Newbie friendliness 83/100
Maintainers usually reply within 1 day
-
The sample application in storage article points to wrong URLMay be free again @prasadf18 claimed this 208 days ago, and no pull request is open. Opendocumentation
Difficulty 1/5 Under an hour Newbie friendliness 62/100
supabase/storage#557 · 1 comment ·
Maintainers usually reply within 1 day
-
REST downloads from the S3 backend drop ETag and Cache-Control on 304 responsesPossibly taken @hsusul claimed this today. Open
Difficulty 3/5 1-2 days Newbie friendliness 35/100
Maintainers usually reply within 1 day
-
S3 UploadPartCopy failures leak reserved upload sizePossibly taken @hsusul claimed this 1 day ago. Open
Difficulty 3/5 Half a day Newbie friendliness 42/100
Maintainers usually reply within 1 day
All issues in supabase/storage
Similar issues
-
Add: Yichang TVOpencheck:passed streams:add
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
Maintainers usually reply within 1 day
-
vtselect: data race in Tempo search tags APIs for invalid TraceQL queriesPossibly taken @Shubham19032004 claimed this today. Openbug
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
VictoriaMetrics/VictoriaTraces#304 ·
Maintainers usually reply within 1 day
-
test: claim-conflict drop leaves both facts active and is never re-proposed (untested review cell)Open
Difficulty 2/5 1-3 hours Newbie friendliness 83/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
microsoft/vscode-pull-request-github#9159 ·
Maintainers usually reply within 1 day
-
[Feature]: Usage page should show API-equivalent cost and say when a connected plan shows info onlyOpenenhancement from-x
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
nightly-labs/openbot#4867 ·
Maintainers usually reply within 1 day