fix(proxy): add path validation guardrail to imageproxy (#2531)

2026-02-28 02:14:05 +07:00
parent 720a75b58d
commit e086081b19
1 changed files with 6 additions and 0 deletions
--- a/server/routes/imageproxy.ts
+++ b/server/routes/imageproxy.ts
@@ -32,6 +32,12 @@ function initTvdbImageProxy() {

 router.get('/:type/*', async (req, res) => {
  const imagePath = req.path.replace(/^\/\w+/, '');
+
+  if (imagePath.startsWith('//') || imagePath.includes('://')) {
+    logger.error('Invalid URL for image proxy', { imagePath });
+    return res.status(403).send('Invalid URL for image proxy');
+  }
+
  try {
    let imageData;
    if (req.params.type === 'tmdb') {