diff --git a/built/index.js b/built/index.js index 84b8227..cdfdf03 100644 --- a/built/index.js +++ b/built/index.js @@ -3,6 +3,7 @@ import { fileURLToPath } from 'node:url'; import { dirname } from 'node:path'; import fastifyStatic from '@fastify/static'; import { createTemp } from './create-temp.js'; +import { FILE_TYPE_BROWSERSAFE } from './const.js'; import { convertToWebpStream, webpDefault } from './image-processor.js'; import { detectType, isMimeImage } from './file-info.js'; import sharp from 'sharp'; @@ -148,6 +149,9 @@ async function proxyHandler(request, reply) { else if (file.mime === 'image/svg+xml') { image = convertToWebpStream(file.path, 2048, 2048); } + else if (!file.mime.startsWith('image/') || !FILE_TYPE_BROWSERSAFE.includes(file.mime)) { + throw new StatusError('Rejected type', 403, 'Rejected type'); + } if (!image) { image = { data: fs.createReadStream(file.path), diff --git a/package.json b/package.json index 7d0540a..d8f6a31 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "misskey-media-proxy", - "version": "0.0.6", + "version": "0.0.9", "description": "The Media Proxy for Misskey", "main": "built/index.js", "packageManager": "pnpm@7.26.0", diff --git a/src/index.ts b/src/index.ts index 09ef82c..aa92f22 100644 --- a/src/index.ts +++ b/src/index.ts @@ -191,6 +191,8 @@ async function proxyHandler(request: FastifyRequest<{ Params: { url: string; }; }; } else if (file.mime === 'image/svg+xml') { image = convertToWebpStream(file.path, 2048, 2048); + } else if (!file.mime.startsWith('image/') || !FILE_TYPE_BROWSERSAFE.includes(file.mime)) { + throw new StatusError('Rejected type', 403, 'Rejected type'); } if (!image) {