search

nkprasad12 / dnd

Web application for TTRPGs.
MIT License
1 stars 0 forks source link

Validate and resolve image paths on the server #68

Closed nkprasad12 closed 3 years ago

nkprasad12 commented 3 years ago

Not a big deal now but a malicious client could easily make everyone fetch arbitrary blobs with the current setup by changing an imageSource

nkprasad12 commented 3 years ago

This is resolved. Images are saved as:

server@/retrieve_image/[]image name]

and resolved on the client side as

serverOrigin/retrieve_image/[image name]

so changing the image address will only make other clients try to retrieve an image that doesn't exist.