External/SnapOtter
1
0
Fork 0
mirror of https://github.com/snapotter-hq/SnapOtter.git synced 2026-08-03 07:46:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: add exotic format decoding and SVG sanitization to all custom-route tools

Browse Source 
Custom-route tools (split, compare, collage, find-duplicates, etc.) only
handled HEIC via ensureSharpCompat, failing on BMP, PSD, RAW, TGA, EXR,
HDR, JXL, and other formats Sharp cannot decode natively. Added the full
decode pipeline from createToolRoute to all 16 affected routes: format
validation via validateImageBuffer, HEIC decoding with actionable error
messages, CLI-based exotic format decoding with nested fallback, and SVG
sanitization to prevent XXE/SSRF/script injection.
This commit is contained in:
SnapOtter
2026-05-13 10:39:17 +08:00
parent f93e864094
commit c15e94c969
14 changed files with 532 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/src/routes/tools/info.ts
+2 -2
View File
@@ -8,7 +8,7 @@ import sharp from "sharp";
import { validateImageBuffer } from "../../lib/file-validation.js";
import { sanitizeFilename } from "../../lib/filename.js";
import { decodeToSharpCompat, needsCliDecode } from "../../lib/format-decoders.js";
import { ensureSharpCompat } from "../../lib/heic-converter.js";
import { decodeHeic } from "../../lib/heic-converter.js";
const execFileAsync = promisify(execFile);
@@ -66,7 +66,7 @@ export function registerInfo(app: FastifyInstance) {
if (detectedFormat && needsCliDecode(detectedFormat)) {
metaBuffer = await decodeToSharpCompat(fileBuffer, detectedFormat, ext);
} else {
metaBuffer = await ensureSharpCompat(fileBuffer);
metaBuffer = await decodeHeic(fileBuffer);
}
}