libervia-backend: sat/plugins/plugin_xep

plugin XEP-0054: reject image without MIME type if it's not PNG

comparison

equal deleted inserted replaced

-:6acaa8244220
+:e624550d5c24
 """Parse a <PHOTO> photo_elt and save the picture"""
 # XXX: this method is launched in a separate thread
 try:
 mime_type = unicode(photo_elt.elements(NS_VCARD, "TYPE").next())
 except StopIteration:
-log.warning(u"no MIME type found, assuming image/png")
+mime_type = None
-mime_type = u"image/png"
 else:
 if not mime_type:
-log.warning(u"empty MIME type, assuming image/png")
+# MIME type not know, we'll only support PNG files
-mime_type = u"image/png"
+# TODO: autodetection using e.g. "magic" module
+#       (https://pypi.org/project/python-magic/)
+mime_type = None
 elif mime_type not in ("image/gif", "image/jpeg", "image/png"):
 if mime_type == "image/x-png":
 # XXX: this old MIME type is still used by some clients
 mime_type = "image/png"
 else:
 log.warning(u"BINVAL element not found")
 raise Failure(exceptions.NotFound())
 if not buf:
 log.warning(u"empty avatar for {jid}".format(jid=entity_jid.full()))
 raise Failure(exceptions.NotFound())
+if mime_type is None:
+log.warning(_(u"no MIME type found for {entity}'s avatar, assuming image/png")
+.format(entity=entity_jid.full()))
+if buf[:8] != b'\x89\x50\x4e\x47\x0d\x0a\x1a\x0a':
+log.warning(u"this is not a PNG file, ignoring it")
+raise Failure(exceptions.DataError())
+else:
+mime_type = u"image/png"
 log.debug(_(u"Decoding binary"))
 decoded = b64decode(buf)
 del buf
 image_hash = sha1(decoded).hexdigest()
 with client.cache.cacheData(

Mercurial > libervia-backend