rosell-dk / webp-convert

Convert jpeg/png to webp with PHP (if at all possible)
MIT License
578 stars 102 forks source link

Stream wrappers are not allowed in destination path #240

Open xpertyst opened 4 years ago

xpertyst commented 4 years ago

Hi, I want to convert image i.e. stored at AWS S3 bucket. I want to fetch and restore WebP image at same path after conversion but this library doesn't allow HTTP in URL. How can I fix that issue. Please help

Thanks in advance

rosell-dk commented 4 years ago

Hi @xpertyst,

I assume you do not have access to a regular filesystem? Otherwise, you can simply download, convert and upload.

I have disallowed stream wrappers because they can be used for Phar Deserialization - and I didn't think anyone would need them.

I can perhaps relax the sanity check a bit. But before we get into that, lets check if it would work for you. To completely remove the guards against stream wrappers, do the following:

  1. In Helpers/PathChecker.php, uncomment the following line (line 60): throw new InvalidInputException('Stream wrappers are not allowed in ' . $text . ' path');

  2. In Helpers/Sanitize.php, replace the following line (line 21): return preg_replace('#^\\w+://#', '', $string); with this: return $string;

domainregistrar commented 4 years ago

I'm also having a similar issue, where I'd like to use a URL instead of file path.

In my case this is because I'm feeding images through a dynamic resizer, but it seems making the tweaks suggested still results in errors.

For example, say I have a URL:

Original file: https://example.com/path/to/original.png Dynamic Resizer: https://example.com/img/100/100/path/to/original.png

Now, I'd like to feed the images through WebPConvert after doing an accept header check so I can reference:

https://example.com/img-webp/img/100/100/path/to/original.png

In my route I then parse this out as "https://example.com/img/100/100/path/to/original.png" -- I want this to be the source for the WebPConvert lib, and then serve the webp dynamically.

(This is all then cached by CDN)

After removing various checks (in addition to the ones you suggested) I still seem to come up against an error saying it's not a valid image.

Would be great to see this functionality added to make it easier for it to act as a dynamic image proxy. :)

joiglifberg commented 3 years ago

@rosell-dk

Hi @xpertyst,

I assume you do not have access to a regular filesystem? Otherwise, you can simply download, convert and upload.

I have disallowed stream wrappers because they can be used for Phar Deserialization - and I didn't think anyone would need them.

I can perhaps relax the sanity check a bit. But before we get into that, lets check if it would work for you. To completely remove the guards against stream wrappers, do the following:

  1. In Helpers/PathChecker.php, uncomment the following line (line 60): throw new InvalidInputException('Stream wrappers are not allowed in ' . $text . ' path');
  2. In Helpers/Sanitize.php, replace the following line (line 21): return preg_replace('#^\\w+://#', '', $string); with this: return $string;

In my case it doesn't help at all when using s3:// protocol.