Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

next/image serves files other than images from public dir #23312

Closed
FDiskas opened this issue Mar 23, 2021 · 2 comments · Fixed by #23366
Closed

next/image serves files other than images from public dir #23312

FDiskas opened this issue Mar 23, 2021 · 2 comments · Fixed by #23366
Assignees
@shuding
Milestone
Iteration 18

Comments

@FDiskas
Copy link

FDiskas commented Mar 23, 2021

What version of Next.js are you using?

10.0.7

What version of Node.js are you using?

14.15.1

What browser are you using?

chrome

What operating system are you using?

linux

How are you deploying your application?

next start

Describe the Bug

next/image package should not serve other files rather then only images excluding svg

Expected Behavior

only image are allowed, excluding svg - it is responsive by it self

To Reproduce

  1. create simple nextjs app
  2. add simple json file to public/locales/en-GB/common.json with some sample json content
  3. run npm build
  4. run npm start
  5. navigate to http://localhost:3000/_next/image?url=/locales/en-GB/common.json&w=640&q=75

image
@FDiskas FDiskas added the bug Issue was opened via the bug report template. label Mar 23, 2021
@timneutkens timneutkens changed the title next/image - security issue? or bug next/image serves files other than images from public dir Mar 23, 2021
@shuding shuding self-assigned this Mar 23, 2021
@shuding shuding added kind: bug and removed bug Issue was opened via the bug report template. labels Mar 23, 2021
@shuding shuding added this to the Iteration 18 milestone Mar 24, 2021
@shuding shuding mentioned this issue Mar 24, 2021
Merged
8 tasks
@kodiakhq kodiakhq bot closed this as completed in #23366 Mar 24, 2021
kodiakhq bot pushed a commit that referenced this issue Mar 24, 2021
@shuding
Make sure the image optimization endpoint only response with images (#…
9821140 
…23366)

If the upstream MIME type isn't prefixed with `image/`, the endpoint should directly response with a 400 error.

## Bug

- [x] Fixes #23312
- [x] Integration tests added

## Feature

- [ ] Implements an existing feature request or RFC. Make sure the feature request has been accepted for implementation before opening a PR.
- [ ] Related issues linked using `fixes #number`
- [ ] Integration tests added
- [ ] Documentation added
- [ ] Telemetry added. In case of a feature if it's used or not.

## Documentation / Examples

- [ ] Make sure the linting passes
@FDiskas
Copy link
Author

FDiskas commented Mar 24, 2021

@shuding thanks - that was fast :o

@shuding shuding mentioned this issue Apr 13, 2021
Closed
SokratisVidros pushed a commit to SokratisVidros/next.js that referenced this issue Apr 20, 2021
@shuding @SokratisVidros
Make sure the image optimization endpoint only response with images (v…
f11b44c 
…ercel#23366)

If the upstream MIME type isn't prefixed with `image/`, the endpoint should directly response with a 400 error.

## Bug

- [x] Fixes vercel#23312
- [x] Integration tests added

## Feature

- [ ] Implements an existing feature request or RFC. Make sure the feature request has been accepted for implementation before opening a PR.
- [ ] Related issues linked using `fixes #number`
- [ ] Integration tests added
- [ ] Documentation added
- [ ] Telemetry added. In case of a feature if it's used or not.

## Documentation / Examples

- [ ] Make sure the linting passes
flybayer pushed a commit to blitz-js/next.js that referenced this issue Apr 29, 2021
@shuding
Make sure the image optimization endpoint only response with images (v…
268ca68 
…ercel#23366)

If the upstream MIME type isn't prefixed with `image/`, the endpoint should directly response with a 400 error.

## Bug

- [x] Fixes vercel#23312
- [x] Integration tests added

## Feature

- [ ] Implements an existing feature request or RFC. Make sure the feature request has been accepted for implementation before opening a PR.
- [ ] Related issues linked using `fixes #number`
- [ ] Integration tests added
- [ ] Documentation added
- [ ] Telemetry added. In case of a feature if it's used or not.

## Documentation / Examples

- [ ] Make sure the linting passes
@balazsorban44
Copy link
Member

This issue has been automatically locked due to no recent activity. If you are running into a similar issue, please create a new issue with the steps to reproduce. Thank you.

@vercel vercel locked as resolved and limited conversation to collaborators Jan 28, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@shuding shuding

Labels
None yet
Projects
None yet
Milestone
Iteration 18
Development

Successfully merging a pull request may close this issue.

Make sure the image optimization endpoint only response with images shuding/next.js
3 participants
@FDiskas @shuding @balazsorban44