Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Presets and Strict Mode for prevent potential image-resize attacks #23

Open
Kostyaval opened this issue Mar 3, 2023 · 1 comment
Open

Comments

@Kostyaval
Copy link

I have been using this plugin, and while it provides great functionality, but I have noticed two key functions that are missing which would greatly improve the plugin's functionality.

  1. Presets: Allowing users to apply preset rules as modifiers. This would streamline the process of applying specific sets of modifiers to images, making the plugin more efficient and user-friendly.

  2. Strict Mode: would disable the use of arbitrary modifiers. In this mode, only presets and allowed modifiers specified in the config would be used to modify images. This would prevent potential image-resize attacks on our server, ensuring the security of our system.

I am willing to contribute to the development of these features if necessary. I believe they would be a valuable addition to the plugin.

Thank you for your consideration.

@rafimaryudwika
Copy link

IMO, it's possible to mitigate image-resize attack by reading modifier from body of request as well, but it should implement HTTP POST method instead GET in current version. It's better to add Very Strict Mode which only allows modifier from HTTP request only so it will increase security.

I want to implement them sometime too.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants