feat: validate image pixel dimensions in MediaUploader#11
Merged
Conversation
MediaUploader.handleFile only checked mime + byte-size, so an oversized image passed the input and failed only on the server confirm with a 422 (DIMENSIONS_EXCEEDED) after the S3 PUT. Add a client-side pixel-dimension + aspect-ratio check via createImageBitmap, validated against the kind's MEDIA_LIMITS (maxWidth/maxHeight, aspectRatio +/- aspectTolerance), so oversized images are rejected at the input with a clear message. SVG is skipped (no raster dimensions). Decode failures and environments without createImageBitmap (e.g. jsdom) fail open and return null, so the server stays the real enforcement. Because MediaGallery wraps the same MediaUploader, this covers logo, banner, screenshot, image and background in every consumer. Adds a test.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
MediaUploader.handleFile only checked mime + byte-size, so an oversized image
passed the input and failed only on the server confirm with a 422
(DIMENSIONS_EXCEEDED) after the S3 PUT. Add a client-side pixel-dimension +
aspect-ratio check via createImageBitmap, validated against the kind's
MEDIA_LIMITS (maxWidth/maxHeight, aspectRatio +/- aspectTolerance), so oversized
images are rejected at the input with a clear message.
SVG is skipped (no raster dimensions). Decode failures and environments without
createImageBitmap (e.g. jsdom) fail open and return null, so the server stays the
real enforcement. Because MediaGallery wraps the same MediaUploader, this covers
logo, banner, screenshot, image and background in every consumer. Adds a test.