diff --git a/pkg/checker/file_type.go b/pkg/checker/file_type.go index cabd5883a..3599270a2 100644 --- a/pkg/checker/file_type.go +++ b/pkg/checker/file_type.go @@ -29,6 +29,10 @@ import ( "strings" ) +const ( + maxImageSize = 8192 * 8192 +) + // IsSupportedImageFile currently answers support image type is // `image/jpeg, image/jpg, image/png, image/gif, image/webp` func IsSupportedImageFile(file io.Reader, ext string) bool { @@ -36,14 +40,42 @@ func IsSupportedImageFile(file io.Reader, ext string) bool { var err error switch ext { case "jpg", "jpeg", "png", "gif": // only allow for `image/jpeg,image/jpg,image/png, image/gif` + if !checkImageSize(file) { + return false + } _, _, err = image.Decode(file) case "ico": // TODO: There is currently no good Golang library to parse whether the image is in ico format. return true case "webp": + if !checkWebpSize(file) { + return false + } _, err = webp.Decode(file) default: return false } return err == nil } + +func checkImageSize(file io.Reader) bool { + config, _, err := image.DecodeConfig(file) + if err != nil { + return false + } + if (config.Width * config.Height) > maxImageSize { + return false + } + return true +} + +func checkWebpSize(file io.Reader) bool { + config, err := webp.DecodeConfig(file) + if err != nil { + return false + } + if (config.Width * config.Height) > maxImageSize { + return false + } + return true +}