40054872667
100%

Ran 24 Oct 2026 02:36AM UTC

Jobs 5

Files 7

Run time 1min

Badge

Embed ▾

Committed 24 Oct 2026 02:36AM UTC coverage: 100.0%. Remained the same

Build # 40054872667

Build Type

push

github

Committed by

marcelometal

Commit Message

Document how to sign image URLs from untrusted input

CryptoURL signs image_url as given and thumbor reads options from the whole
path, so an image_url that starts with option segments injects them: against
thumbor 7.8.0, signing width=60, height=40 and
image_url="filters:format(png)/image.jpg" returned a PNG. Characters browsers
percent-encode in a path broke the signature instead, because thumbor checks
it against the raw path it receives: a non-ASCII name, a space or a query
string in the image URL all got 400 Malformed URL. The README now explains
both and recommends quote(image_url, safe=""), warning that the default
safe="/" still lets "smart/photo.jpg" add smart, and that an already encoded
path must be unquoted first or thumbor looks for a literal "%20". A test
parses the signed path with Url.regex() so the recipe stays true.

With the same thumbor and its file loader with HTTP fallback, encoded values
loaded a subdirectory, a non-ASCII name, a space, an absolute URL, a query
string (fetched upstream as ?v=1) and a scheme-less host. An encoded
injection was read as a literal path, and ALLOWED_SOURCES rejected a
disallowed host encoded or not. Encoding changes the signed path of every URL
with a slash, so it is a choice for callers; URLs signed without it keep
working.

Coverage Stats

314 of 314 relevant lines covered (100.0%)

5.0 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
1	run-3.13 - 40054872667.1	24 Oct 2026 02:36AM UTC	7	100.0	GitHub Action Run
2	run-3.12 - 40054872667.2	24 Oct 2026 02:36AM UTC	7	100.0	GitHub Action Run
3	run-3.15 - 40054872667.3	24 Oct 2026 02:36AM UTC	7	100.0	GitHub Action Run
4	run-3.14 - 40054872667.4	24 Oct 2026 02:36AM UTC	7	100.0	GitHub Action Run
5	run-3.11 - 40054872667.5	24 Oct 2026 02:36AM UTC	7	100.0	GitHub Action Run

thumbor / libthumbor / 40054872667
100%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 40054872667

thumbor / libthumbor / 40054872667 100%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 40054872667

thumbor / libthumbor / 40054872667
100%

README BADGES
x