image以外はproxyしないように (#5051)

misskey-dev · Jun 14, 2019 · 67dda01 · 67dda01
1 parent e9dc54c
commit 67dda01
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/src/server/proxy/proxy-media.ts b/src/server/proxy/proxy-media.ts
@@ -17,6 +17,8 @@ export async function proxyMedia(ctx: Koa.BaseContext) {
 
 		const [type, ext] = await detectMine(path);
 
+		if (!type.startsWith('image/')) throw 403;
+
 		let image: IImage;
 
 		if ('static' in ctx.query && ['image/png', 'image/gif'].includes(type)) {