Backend saves image from URL to local filesystem #25

New issue

Open

opened 2026-02-13 21:17:38 +00:00 by aniram · 1 comment

aniram commented

2026-02-13 21:17:38 +00:00

Owner

Something to be aware of is that this feature has been implemented in a way that if the API gets compromised the backend might be compromised too since the images the API returns are being saved to the server's filesystem, maybe I should put the images in a isolated folder or volume with limited access.

Originally posted by @aniram in #16 (comment)

aniram added the

Kind/Security

label

2026-02-13 21:18:15 +00:00

aniram commented

2026-02-13 21:20:03 +00:00

Author

Owner

Concerns:
i) The backend makes a request based on the URL from the img tag. Injection possible?
ii) The request goes to the external API and as part of the cache strategy the response body is saved on the local filesystem, I hope it's an image, but it could be anything. It could be also enormous and take all of the free space. Maybe I should set constraints for the file size. I should also isolate the avatar's folder from the rest of the backend.

Concerns: i) The backend makes a request based on the URL from the img tag. Injection possible? ii) The request goes to the external API and as part of the cache strategy the response body is saved on the local filesystem, I hope it's an image, but it could be anything. It could be also enormous and take all of the free space. Maybe I should set constraints for the file size. I should also isolate the avatar's folder from the rest of the backend.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

aniram/cidadon#25

No description provided.

Rows
Columns