Avatar Proxy allows requesting any resource from literally every origin #1013
Labels
Comments
rflrkn
added
awaiting triage
|
Hi, same as #1012 |
|
Hi, yep I'm fixing it. A patch will be available very soon |
3 tasks
Fallenbagel
pushed a commit
that referenced
this issue
Oct 17, 2024
* fix: rewrite avatarproxy and CachedImage Avatar proxy was allowing every request to be proxied, no matter the original ressource's origin or filetype. This PR fixes it be allowing only relevant resources to be cached, i.e. Jellyfin/Emby images and TMDB images. fix #1012, #1013 * fix: resolve CodeQL error * fix: resolve CodeQL error * fix: resolve review comments * fix: resolve review comment * fix: resolve CodeQL error * fix: update imageproxy path
|
🎉 This issue has been resolved in version 2.0.1 🎉 The release is available on:
Your semantic-release bot 📦🚀 |
bonswouar
pushed a commit
to bonswouar/jellyseerr
that referenced
this issue
Nov 10, 2024
* fix: rewrite avatarproxy and CachedImage Avatar proxy was allowing every request to be proxied, no matter the original ressource's origin or filetype. This PR fixes it be allowing only relevant resources to be cached, i.e. Jellyfin/Emby images and TMDB images. fix Fallenbagel#1012, Fallenbagel#1013 * fix: resolve CodeQL error * fix: resolve CodeQL error * fix: resolve review comments * fix: resolve review comment * fix: resolve CodeQL error * fix: update imageproxy path
thibodelanghe
pushed a commit
to thibodelanghe/jellyseerr
that referenced
this issue
Dec 18, 2024
* fix: rewrite avatarproxy and CachedImage Avatar proxy was allowing every request to be proxied, no matter the original ressource's origin or filetype. This PR fixes it be allowing only relevant resources to be cached, i.e. Jellyfin/Emby images and TMDB images. fix Fallenbagel#1012, Fallenbagel#1013 * fix: resolve CodeQL error * fix: resolve CodeQL error * fix: resolve review comments * fix: resolve review comment * fix: resolve CodeQL error * fix: update imageproxy path
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Description
I just noticed that the avatar proxy allows proxying/loading literally any request - no matter the original ressource's origin or filetype.
Version
2.0.0
Steps to Reproduce
Try requesting (e. g.):
https://{YOUR-JELLYSEER-HOST}/avatarproxy/https://ash-speed.hetzner.com/100MB.bin
Screenshots
No response
Logs
No response
Platform
desktop
Device
MacBook Pro (doesn't matter tho)
Operating System
macOS 15.0.1
Browser
Zen Browser (Firefox)
Additional Context
The avatar proxy should only allow loading ressources from the configured Jellyfin host (or it's external URL) and maybe also check MIME types
Code of Conduct
The text was updated successfully, but these errors were encountered: