funman300/Ferrous-Solitaire
1
1
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 48 Wiki Activity

fix(server): sniff avatar magic bytes instead of trusting Content-Type #141

New Issue
Closed
opened 2026-07-07 03:06:04 +00:00 by funman300 · 0 comments
funman300 commented 2026-07-07 03:06:04 +00:00
Owner
Copy Link
Copy Source

Review finding L3 (2026-07-06). upload_avatar (auth.rs) derives the stored file extension from the request's Content-Type header without checking the bytes. SVG is excluded and a 1MB cap + rate limiting exist, so impact is low — but any bytes can currently be stored as .png/.jpg/.webp/.gif and served back under that type. Fix: check magic bytes (PNG/JPEG/WebP/GIF signatures are all trivial prefixes) and reject mismatches.

Principle: never trust client-declared metadata about content you will re-serve; derive it from the content itself.

🤖 Generated with Claude Code

Review finding L3 (2026-07-06). `upload_avatar` (auth.rs) derives the stored file extension from the request's Content-Type header without checking the bytes. SVG is excluded and a 1MB cap + rate limiting exist, so impact is low — but any bytes can currently be stored as .png/.jpg/.webp/.gif and served back under that type. Fix: check magic bytes (PNG/JPEG/WebP/GIF signatures are all trivial prefixes) and reject mismatches. **Principle:** never trust client-declared metadata about content you will re-serve; derive it from the content itself. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
android
bug
correctness
enhancement
performance
security
server
test
ui
ux
wasm
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
funman300 (Alex)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: funman300/Ferrous-Solitaire#141
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?