Security: ImageProcessor.processFromUrl() missing download size check #48

New issue

Open

opened 2026-04-22 00:34:57 +00:00 by frank · 0 comments

frank commented

2026-04-22 00:34:57 +00:00

Owner

Direct uploads enforce a 10MB MAX_UPLOAD_SIZE limit, but processFromUrl() downloads images from URLs without checking file size. Could be used to exhaust disk space.

Fix: Add Content-Length check or stream-with-limit when downloading from URL.

Files: api/services/ImageProcessor.php
Tech debt: TD11 | Security audit: related to INP03

Direct uploads enforce a 10MB MAX_UPLOAD_SIZE limit, but processFromUrl() downloads images from URLs without checking file size. Could be used to exhaust disk space. Fix: Add Content-Length check or stream-with-limit when downloading from URL. Files: api/services/ImageProcessor.php Tech debt: TD11 | Security audit: related to INP03