Upstream/bitwarden-server
1
0
Fork 0
mirror of https://github.com/bitwarden/server.git synced 2024-11-26 12:55:17 +01:00
Code Issues Projects Releases Wiki Activity

allowed media types for icon images

Browse Source
This commit is contained in:
Kyle Spearrin 2018-03-03 14:12:57 -05:00
parent cf2183471c
commit 8d681738c8
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/Icons/Controllers/IconsController.cs
View File

@ -1,4 +1,5 @@
using System; using System;
using System.Collections.Generic;
using System.Linq; using System.Linq;
using System.Net; using System.Net;
using System.Net.Http; using System.Net.Http;
@ -18,6 +19,11 @@ namespace Bit.Icons.Controllers
AllowAutoRedirect = false, AllowAutoRedirect = false,
AutomaticDecompression = DecompressionMethods.GZip | DecompressionMethods.Deflate AutomaticDecompression = DecompressionMethods.GZip | DecompressionMethods.Deflate
}); });
private static readonly HashSet<string> _allowedMediaTypes = new HashSet<string>{
"image/png",
"image/x-icon",
"image/jpeg"
};
private readonly IMemoryCache _memoryCache; private readonly IMemoryCache _memoryCache;
private readonly IDomainMappingService _domainMappingService; private readonly IDomainMappingService _domainMappingService;
private readonly IconsSettings _iconsSettings; private readonly IconsSettings _iconsSettings;
@ -54,7 +60,8 @@ namespace Bit.Icons.Controllers
$"&fallback_icon_url=https://raw.githubusercontent.com/bitwarden/web/master/src/images/fa-globe.png"; $"&fallback_icon_url=https://raw.githubusercontent.com/bitwarden/web/master/src/images/fa-globe.png";
var response = await _httpClient.GetAsync(iconUrl); var response = await _httpClient.GetAsync(iconUrl);
response = await FollowRedirectsAsync(response, 1); response = await FollowRedirectsAsync(response, 1);
if(!response.IsSuccessStatusCode) if(!response.IsSuccessStatusCode ||
!_allowedMediaTypes.Contains(response.Content.Headers.ContentType.MediaType))
{ {
return new NotFoundResult(); return new NotFoundResult();
} }