Contrib.social

Filter module: "Restrict images to this site" incorrectly filters local images whose src attribute includes a query string

Open on Drupal.org β†’
Created on 8 October 2023, over 1 year ago
Updated 9 October 2023, over 1 year ago

Problem/Motivation

When a local image's src attribute contains a query parameter - e.g. /sites/default/files/image.gif?foo=bar, the filter module incorrectly tries to check that a local file with this query string exists, in filter.module _filter_html_image_secure_process() line 800 (Drupal 9):

if (@getimagesize($local_image_path)) {

For example, the below image will be removed

<img class="thumbnail img-responsive" src="/sites/default/files/2022-10-digitise-your-panel-projects-with-see--company-logo-wp-promotions.jpg?anchor=center&mode=crop&rnd=132943951680000000" alt="some text">

Steps to reproduce

Embed an img tag in a field which can accept HTML such as a node body and add ?example to the src attribute, like:

<img src="/sites/default/files/image.jpg?example" />

The image is removed by the filter when it should not be.

Proposed resolution

A stop-gap solution is to remove anything including and after a ? and/or a # in an image's src attribute.

I will attach a patch in the second comment.

A better solution than the attached patch is to make the check for local files significantly more-robust but that might require a rewrite by someone considerably more-familiar with how Drupal/PHP interacts with the various filesystems it can run on.

Remaining tasks

Test coverage, ensure the patch actually works as expected, etc Β―\_(ツ)_/Β―

User interface changes

None.

API changes

None.

Data model changes

None.

Release notes snippet

Filter module: improve handling of src URLs which contain query or hash parameters when checking for local images.

πŸ› Bug report
Status

Needs work

Version

11.0 πŸ”₯

Component
FilterΒ  β†’

Last updated about 2 hours ago

No maintainer
Created by

πŸ‡¬πŸ‡§United Kingdom alexharries

Live updates comments and jobs are added and updated live.
  • Needs tests

    The change is currently missing an automated test that fails when run with the original code, and succeeds when the bug has been fixed.

Sign in to follow issues

Comments & Activities

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024