mirrors/bookwyrm
1
0
Fork 1
mirror of https://github.com/bookwyrm-social/bookwyrm.git synced 2025-01-10 17:25:35 +00:00
Code Issues Projects Releases Wiki Activity

Check image extensions before saving

Browse source
This commit is contained in:
Mouse Reeve 2022-02-01 21:18:25 -08:00
parent 1dfe4d0f52
commit 754e24812b
3 changed files with 16 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
bookwyrm/connectors/abstract_connector.py
View file

@ -1,7 +1,9 @@
""" functionality outline for a book data connector """ """ functionality outline for a book data connector """
from abc import ABC, abstractmethod from abc import ABC, abstractmethod
import imghdr
import logging import logging
from django.core.files.base import ContentFile
from django.db import transaction from django.db import transaction
import requests import requests
from requests.exceptions import RequestException from requests.exceptions import RequestException
@ -291,9 +293,17 @@ def get_image(url, timeout=10):
except RequestException as err: except RequestException as err:
logger.exception(err) logger.exception(err)
return None return None
if not resp.ok: if not resp.ok:
return None return None
return resp
image_content = ContentFile(resp.content)
extension = imghdr.what(None, image_content.read())
if not extension:
logger.exception("File requested was not an image: %s", url)
return None
return image_content, extension
class Mapping: class Mapping:

8
bookwyrm/models/fields.py
View file

@ -1,6 +1,5 @@
""" activitypub-aware django model fields """ """ activitypub-aware django model fields """
from dataclasses import MISSING from dataclasses import MISSING
import imghdr
import re import re
from uuid import uuid4 from uuid import uuid4
from urllib.parse import urljoin from urllib.parse import urljoin
@ -9,7 +8,6 @@ import dateutil.parser
from dateutil.parser import ParserError from dateutil.parser import ParserError
from django.contrib.postgres.fields import ArrayField as DjangoArrayField from django.contrib.postgres.fields import ArrayField as DjangoArrayField
from django.core.exceptions import ValidationError from django.core.exceptions import ValidationError
from django.core.files.base import ContentFile
from django.db import models from django.db import models
from django.forms import ClearableFileInput, ImageField as DjangoImageField from django.forms import ClearableFileInput, ImageField as DjangoImageField
from django.utils import timezone from django.utils import timezone
@ -443,12 +441,10 @@ class ImageField(ActivitypubFieldMixin, models.ImageField):
except ValidationError: except ValidationError:
return None return None
response = get_image(url) image_content, extension = get_image(url)
if not response: if not image_content:
return None return None
image_content = ContentFile(response.content)
extension = imghdr.what(None, image_content.read()) or ""
image_name = f"{uuid4()}.{extension}" image_name = f"{uuid4()}.{extension}"
return [image_name, image_content] return [image_name, image_content]

8
bookwyrm/views/books/books.py
View file

@ -2,7 +2,6 @@
from uuid import uuid4 from uuid import uuid4
from django.contrib.auth.decorators import login_required, permission_required from django.contrib.auth.decorators import login_required, permission_required
from django.core.files.base import ContentFile
from django.core.paginator import Paginator from django.core.paginator import Paginator
from django.db.models import Avg, Q from django.db.models import Avg, Q
from django.http import Http404 from django.http import Http404
@ -144,13 +143,12 @@ def upload_cover(request, book_id):
def set_cover_from_url(url): def set_cover_from_url(url):
"""load it from a url""" """load it from a url"""
try: try:
image_file = get_image(url) image_content, extension = get_image(url)
except: # pylint: disable=bare-except except: # pylint: disable=bare-except
return None return None
if not image_file: if not image_content:
return None return None
image_name = str(uuid4()) + "." + url.split(".")[-1] image_name = str(uuid4()) + "." + extension
image_content = ContentFile(image_file.content)
return [image_name, image_content] return [image_name, image_content]