thumbor / thumbor / 37090862198

92%

push

github

feat: add ALLOWED_SIZES to restrict requested sizes

Without URL signing, a client can ask thumbor for every width and height
combination and make it generate and cache a new image for each one.
ALLOWED_SIZES lists the sizes image URLs may request, as "WIDTHxHEIGHT"
strings, and the imaging handler answers any other size with a 400 before the
blacklist, the signature check, the result storage or the loader run. Entries
are compared literally with the size parsed from the URL, so 0 (omitted or
proportional) and orig must be listed explicitly, while flips and fit-in do
not change the compared size. The server refuses to start when the option is
not a list or an entry is not canonical. The default empty list allows every
size.

Issue #1624 proposed separate ALLOWED_WIDTHS and ALLOWED_HEIGHTS lists. Pairs
were chosen because two lists allow their whole cross product, N squared sizes
for N real ones, and setting only one of them silently leaves the other axis
open. The option narrows only the size segment: unsigned URLs can still vary
crop, filters and other options, and fit-in can return smaller images, so the
docs point to URL signing as the way to stop tampering.

19 of 19 new or added lines in 3 files covered. (100.0%)

4465 of 4865 relevant lines covered (91.78%)

4.59 hits per line