allow setting max height and width

This is primarily added to prevent a denial of service attack where
insanely large images are requested, eating up CPU.

imageproxy.go

@@ -21,6 +21,8 @@ func main() {
 
 	p := proxy.NewProxy(nil)
 	p.Cache = cache.NewMemoryCache()
+	p.MaxWidth = 2000
+	p.MaxHeight = 2000
 	if *whitelist != "" {
 		p.Whitelist = strings.Split(*whitelist, ",")
 	}

proxy/proxy.go

@@ -69,6 +69,9 @@ type Proxy struct {
 
 	// Whitelist specifies a list of remote hosts that images can be proxied from.  An empty list means all hosts are allowed.
 	Whitelist []string
+
+	MaxWidth  int
+	MaxHeight int
 }
 
 // NewProxy constructs a new proxy.  The provided http Client will be used to
@@ -88,6 +91,13 @@ func (p *Proxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if p.MaxWidth > 0 && req.Options.Width > p.MaxWidth {
+		req.Options.Width = p.MaxWidth
+	}
+	if p.MaxHeight > 0 && req.Options.Height > p.MaxHeight {
+		req.Options.Height = p.MaxHeight
+	}
+
 	u := req.URL.String()
 	glog.Infof("request for image: %v", u)