hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

fix(media_proxy): do not proxy data: URLs

Browse source 
Ported from Akkoma 7632765b4.

Co-authored-by: nopjmp <nop@unearthly.dev>
This commit is contained in:
Lain Soykaf 2026-10-31 15:37:42 +04:00
commit 542f8b2aef
No known key found for this signature in database
3 changed files with 17 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

1
changelog.d/media-proxy-data-urls.fix Normal file
View file

@ -0,0 +1 @@
MediaProxy: Do not proxy data: URLs

6
lib/pleroma/web/media_proxy.ex
View file

@ -45,7 +45,7 @@ defmodule Pleroma.Web.MediaProxy do
def url("/" <> _ = url), do: url def url("/" <> _ = url), do: url
def url(url) do def url(url) do
if enabled?() and url_proxiable?(url) do if enabled?() and not data_url?(url) and url_proxiable?(url) do
encode_url(url) encode_url(url)
else else
url url
@ -61,7 +61,7 @@ defmodule Pleroma.Web.MediaProxy do
def preview_url("//" <> _ = url, pparams), do: preview_url("https:" <> url, pparams) def preview_url("//" <> _ = url, pparams), do: preview_url("https:" <> url, pparams)
def preview_url(url, preview_params) do def preview_url(url, preview_params) do
if preview_enabled?() do if preview_enabled?() and not data_url?(url) do
encode_preview_url(url, preview_params) encode_preview_url(url, preview_params)
else else
url(url) url(url)
@ -74,6 +74,8 @@ defmodule Pleroma.Web.MediaProxy do
# non-local non-whitelisted URLs through it and be sure that body size constraint is preserved. # non-local non-whitelisted URLs through it and be sure that body size constraint is preserved.
def preview_enabled?, do: enabled?() and !!Config.get([:media_preview_proxy, :enabled]) def preview_enabled?, do: enabled?() and !!Config.get([:media_preview_proxy, :enabled])
defp data_url?(url), do: url |> String.slice(0, 5) |> String.downcase() == "data:"
def local?(url), do: String.starts_with?(url, Endpoint.url()) def local?(url), do: String.starts_with?(url, Endpoint.url())
def whitelisted?(url) do def whitelisted?(url) do

12
test/pleroma/web/media_proxy_test.exs
View file

@ -45,6 +45,18 @@ defmodule Pleroma.Web.MediaProxyTest do
assert MediaProxy.url(local_root) == local_root assert MediaProxy.url(local_root) == local_root
end end
test "ignores data url" do
assert MediaProxy.url("data:image/png;base64,AAAA") == "data:image/png;base64,AAAA"
assert MediaProxy.url("DATA:image/png;base64,AAAA") == "DATA:image/png;base64,AAAA"
end
test "preview_url ignores data url" do
clear_config([:media_preview_proxy, :enabled], true)
assert MediaProxy.preview_url("data:image/png;base64,AAAA") ==
"data:image/png;base64,AAAA"
end
test "encodes and decodes URL" do test "encodes and decodes URL" do
url = "https://pleroma.soykaf.com/static/logo.png" url = "https://pleroma.soykaf.com/static/logo.png"
encoded = MediaProxy.url(url) encoded = MediaProxy.url(url)