Infrastructure/imageproxy
0
Fork 0
mirror of https://github.com/willnorris/imageproxy.git synced 2024-12-16 21:56:43 -05:00
Code Issues Activity

remove specific denial error from response

Browse source 
the specific denial error message reveals more about the imageproxy
configuration than it should, such as what hosts are denied.  Instead,
log the full error, but return a generic message that the requested URL
is not allowed.
This commit is contained in:
Will Norris 2019-03-22 03:44:36 +00:00
parent 2612fa4111
commit 7e19b5ca6b
1 changed files with 16 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
imageproxy.go
View file

@ -22,6 +22,7 @@ import (
"crypto/hmac" "crypto/hmac"
"crypto/sha256" "crypto/sha256"
"encoding/base64" "encoding/base64"
"errors"
"fmt" "fmt"
"io" "io"
"io/ioutil" "io/ioutil"
@ -152,8 +153,8 @@ func (p *Proxy) serveImage(w http.ResponseWriter, r *http.Request) {
req.Options.ScaleUp = p.ScaleUp req.Options.ScaleUp = p.ScaleUp
if err := p.allowed(req); err != nil { if err := p.allowed(req); err != nil {
log.Print(err) log.Printf("%s: %v", err, req)
http.Error(w, err.Error(), http.StatusForbidden) http.Error(w, msgNotAllowed, http.StatusForbidden)
return return
} }
@ -184,9 +185,8 @@ func (p *Proxy) serveImage(w http.ResponseWriter, r *http.Request) {
contentType, _, _ := mime.ParseMediaType(resp.Header.Get("Content-Type")) contentType, _, _ := mime.ParseMediaType(resp.Header.Get("Content-Type"))
if resp.ContentLength != 0 && !contentTypeMatches(p.ContentTypes, contentType) { if resp.ContentLength != 0 && !contentTypeMatches(p.ContentTypes, contentType) {
msg := fmt.Sprintf("forbidden content-type: %q", contentType) log.Printf("content-type not allowed: %q", contentType)
log.Print(msg) http.Error(w, msgNotAllowed, http.StatusForbidden)
http.Error(w, msg, http.StatusForbidden)
return return
} }
w.Header().Set("Content-Type", contentType) w.Header().Set("Content-Type", contentType)
@ -217,6 +217,14 @@ func copyHeader(dst, src http.Header, keys ...string) {
} }
} }
var (
errReferrer = errors.New("request does not contain an allowed referrer")
errDeniedHost = errors.New("request contains a denied host")
errNotAllowed = errors.New("request does not contain an allowed host or valid signature")
msgNotAllowed = "requested URL is not allowed"
)
// allowed determines whether the specified request contains an allowed // allowed determines whether the specified request contains an allowed
// referrer, host, and signature. It returns an error if the request is not // referrer, host, and signature. It returns an error if the request is not
// allowed. // allowed.
@ -226,11 +234,11 @@ func (p *Proxy) allowed(r *Request) error {
p.AllowHosts = p.Whitelist p.AllowHosts = p.Whitelist
} }
if len(p.Referrers) > 0 && !referrerMatches(p.Referrers, r.Original) { if len(p.Referrers) > 0 && !referrerMatches(p.Referrers, r.Original) {
return fmt.Errorf("request does not contain an allowed referrer: %v", r) return errReferrer
} }
if hostMatches(p.DenyHosts, r.URL) { if hostMatches(p.DenyHosts, r.URL) {
return fmt.Errorf("request contains a denied host %v", r) return errDeniedHost
} }
if len(p.AllowHosts) == 0 && len(p.SignatureKey) == 0 { if len(p.AllowHosts) == 0 && len(p.SignatureKey) == 0 {
@ -245,7 +253,7 @@ func (p *Proxy) allowed(r *Request) error {
return nil return nil
} }
return fmt.Errorf("request does not contain an allowed host or valid signature: %v", r) return errNotAllowed
} }
// contentTypeMatches returns whether contentType matches one of the allowed patterns. // contentTypeMatches returns whether contentType matches one of the allowed patterns.