thumbor / thumbor / 26697350452

89%

push

github

fix(filters): cap proportion value to prevent DoS

The proportion filter accepted unbounded float values, allowing an
attacker to trigger arbitrarily large image resizes (e.g.
proportion(10000)) that exhaust CPU and memory — a remote DoS vector
when unsafe URLs are enabled or when a valid signed URL can be obtained.

Reject any value outside the documented range (0.0, 1.0] before any
arithmetic is performed, making out-of-range calls a silent no-op.

Add tests covering values above 1.0, zero, and negative values.

2 of 2 new or added lines in 1 file covered. (100.0%)

3942 of 4433 relevant lines covered (88.92%)

4.45 hits per line