-
Notifications
You must be signed in to change notification settings - Fork 66
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. Weβll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: add limits for modifiers and dimensions #152
base: main
Are you sure you want to change the base?
Conversation
Taking into consideration the deployment issues of existing users and to avoid any breaking changes, the default values will retain all settings. By limiting the maximum pixels, potential damage caused by attacks can be minimized. |
Codecov Report
@@ Coverage Diff @@
## main #152 +/- ##
==========================================
- Coverage 56.91% 56.39% -0.52%
==========================================
Files 10 10
Lines 940 977 +37
Branches 41 42 +1
==========================================
+ Hits 535 551 +16
- Misses 405 426 +21
|
Is there any way I can continue to promote this PR? Because we're suffering from memory crashes due to mass production of images. |
I guess until @pi0 can have a look at it, you can use your fork version @ausir0726 |
I wonder if validating modifiers via a Joi, zod or typebox schema would be the better approach? |
π Linked issue
#45
β Type of change
π Description
Based on the issues mentioned, using encrypted URLs as a deterrent against abuse should be considered. However, inspired by Cloudinary's approach (where the server stops serving images beyond 8000px, which likely meets current screen usage), and taking into account the limitations on images in the ImageKit.io documentation, we have decided to impose restrictions on the usage of modifiers. Additionally, requests for width or height must conform to the maximum limits. This configuration serves as the minimum guarantee to prevent server abuse when URL encryption is not applied.
Furthermore, an example of using IPX_DOMAINS is added because it defaults to an empty array, but the input value is in the form of a comma-separated string, leading to confusion due to the different data types in use.
ImageKit.io doc about limits image : https://docs.imagekit.io/limits-and-troubleshooting/limits
π Checklist