Changeset 61 in code for trunk

Timestamp:

Dec 1, 2016, 1:01:22 PM (9 years ago)

Author:

alex

Message:

[mod] data scheme URL : allow only images (png, jpeg, pjpeg, gif, webp)

File:

• trunk/morty.go (modified) (1 diff)

trunk/morty.go

@@ -688 +688 @@
         // TODO check malicious data: - e.g. data:script
         if scheme == "data:" {
-                return string(uri), nil
+                if bytes.HasPrefix(uri, []byte("data:image/png")) ||
+                        bytes.HasPrefix(uri, []byte("data:image/jpeg")) ||
+                        bytes.HasPrefix(uri, []byte("data:image/pjpeg")) ||
+                        bytes.HasPrefix(uri, []byte("data:image/gif")) ||
+                        bytes.HasPrefix(uri, []byte("data:image/webp")) {
+                        // should be safe
+                        return string(uri), nil
+                } else {
+                        // unsafe data
+                        return "", nil
+                }
         }