From 7112341c51284994e968357163548eea5ee63882 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Simon=20Mart=C3=ADn?= Date: Fri, 11 May 2018 17:41:00 +0200 Subject: [PATCH 1/6] checkStaticImageFormat middleware --- .../api/middlewares/check-static-image-format.js | 11 +++++++++++ 1 file changed, 11 insertions(+) create mode 100644 lib/cartodb/api/middlewares/check-static-image-format.js diff --git a/lib/cartodb/api/middlewares/check-static-image-format.js b/lib/cartodb/api/middlewares/check-static-image-format.js new file mode 100644 index 00000000..d72fcb81 --- /dev/null +++ b/lib/cartodb/api/middlewares/check-static-image-format.js @@ -0,0 +1,11 @@ +const VALID_IMAGE_FORMATS = ['png', 'jpg', 'jpeg']; + +module.exports = function checkStaticImageFormat () { + return function checkStaticImageFormatMiddleware (req, res, next) { + if(!VALID_IMAGE_FORMATS.includes(req.params.format.toLowerCase())) { + return next(new Error(`Unsupported image format "${req.params.format}"`)); + } + + next(); + }; +}; From db7b4fa937c421b3d9cc241e2aeba1b796a25abe Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Simon=20Mart=C3=ADn?= Date: Fri, 11 May 2018 17:41:26 +0200 Subject: [PATCH 2/6] static image format tests --- test/acceptance/analysis/named-maps.js | 35 +++++++++++++++ test/acceptance/named_maps_static_view.js | 53 +++++++++++++++++++++++ 2 files changed, 88 insertions(+) diff --git a/test/acceptance/analysis/named-maps.js b/test/acceptance/analysis/named-maps.js index 42fb19d0..98316d2d 100644 --- a/test/acceptance/analysis/named-maps.js +++ b/test/acceptance/analysis/named-maps.js @@ -261,6 +261,41 @@ describe('named-maps analysis', function() { ); }); + it('should return and an error requesting unsupported image format', function(done) { + assert.response( + server, + { + url: '/api/v1/map/static/center/' + layergroupid + '/4/42/-3/320/240.gif', + method: 'GET', + encoding: 'binary', + headers: { + host: username + } + }, + { + status: 400, + headers: { + 'Content-Type': 'application/json; charset=utf-8' + } + }, + function(res, err) { + assert.ifError(err); + assert.deepEqual( + JSON.parse(res.body), + { + errors:['Unsupported image format \"gif\"'], + errors_with_context:[{ + type: 'unknown', + message: 'Unsupported image format \"gif\"' + }] + } + ); + done(); + + } + ); + }); + }); describe('auto-instantiation', function() { diff --git a/test/acceptance/named_maps_static_view.js b/test/acceptance/named_maps_static_view.js index 9844c667..69c4e56c 100644 --- a/test/acceptance/named_maps_static_view.js +++ b/test/acceptance/named_maps_static_view.js @@ -282,4 +282,57 @@ describe('named maps static view', function() { }); }); + it('should return an error requesting unsupported image format', function (done) { + var view = { + zoom: 4, + center: { + lng: 40, + lat: 20 + } + }; + + templateMaps.addTemplate(username, createTemplate(view), function (err) { + if (err) { + return done(err); + } + + var url = `/api/v1/map/static/named/${templateName}/640/480.gif`; + + + var requestOptions = { + url: url, + method: 'GET', + headers: { + host: username + }, + encoding: 'binary' + }; + + var expectedResponse = { + status: 400, + headers: { + 'Content-Type': 'application/json; charset=utf-8' + } + }; + + // this could be removed once named maps are invalidated, otherwise you hits the cache + var server = new CartodbWindshaft(serverOptions); + + assert.response(server, requestOptions, expectedResponse, function (res, err) { + assert.ifError(err); + assert.deepEqual( + JSON.parse(res.body), + { + errors:['Unsupported image format \"gif\"'], + errors_with_context:[{ + type: 'unknown', + message: 'Unsupported image format \"gif\"' + }] + } + ); + done(); + }); + }); + }); + }); From e96a9f0b46745ee6878f268f9fe547a51428f4a0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Simon=20Mart=C3=ADn?= Date: Fri, 11 May 2018 17:42:28 +0200 Subject: [PATCH 3/6] static image format controllers --- lib/cartodb/api/map/preview-layergroup-controller.js | 2 ++ lib/cartodb/api/map/preview-template-controller.js | 4 +++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/lib/cartodb/api/map/preview-layergroup-controller.js b/lib/cartodb/api/map/preview-layergroup-controller.js index 29db8729..5e9144c3 100644 --- a/lib/cartodb/api/map/preview-layergroup-controller.js +++ b/lib/cartodb/api/map/preview-layergroup-controller.js @@ -11,6 +11,7 @@ const cacheControlHeader = require('../middlewares/cache-control-header'); const cacheChannelHeader = require('../middlewares/cache-channel-header'); const surrogateKeyHeader = require('../middlewares/surrogate-key-header'); const lastModifiedHeader = require('../middlewares/last-modified-header'); +const checkStaticImageFormat = require('../middlewares/check-static-image-format'); module.exports = class PreviewLayergroupController { constructor ( @@ -43,6 +44,7 @@ module.exports = class PreviewLayergroupController { dbConnSetup(this.pgConnection), rateLimit(this.userLimitsBackend, RATE_LIMIT_ENDPOINTS_GROUPS.STATIC), cleanUpQueryParams(['layer']), + checkStaticImageFormat(), createMapStoreMapConfigProvider( this.mapStore, this.userLimitsBackend, diff --git a/lib/cartodb/api/map/preview-template-controller.js b/lib/cartodb/api/map/preview-template-controller.js index 9f5257a3..b0359e69 100644 --- a/lib/cartodb/api/map/preview-template-controller.js +++ b/lib/cartodb/api/map/preview-template-controller.js @@ -7,6 +7,7 @@ const cacheControlHeader = require('../middlewares/cache-control-header'); const cacheChannelHeader = require('../middlewares/cache-channel-header'); const surrogateKeyHeader = require('../middlewares/surrogate-key-header'); const lastModifiedHeader = require('../middlewares/last-modified-header'); +const checkStaticImageFormat = require('../middlewares/check-static-image-format'); const rateLimit = require('../middlewares/rate-limit'); const { RATE_LIMIT_ENDPOINTS_GROUPS } = rateLimit; @@ -52,6 +53,7 @@ PreviewTemplateController.prototype.register = function (mapRouter) { dbConnSetup(this.pgConnection), rateLimit(this.userLimitsBackend, RATE_LIMIT_ENDPOINTS_GROUPS.STATIC_NAMED), cleanUpQueryParams(['layer', 'zoom', 'lon', 'lat', 'bbox']), + checkStaticImageFormat(), namedMapProvider({ namedMapProviderCache: this.namedMapProviderCache, label: 'STATIC_VIZ_MAP', forcedFormat: 'png' @@ -253,7 +255,7 @@ function getImage({ previewBackend, label }) { height = +height; const format = req.params.format === 'jpg' ? 'jpeg' : 'png'; - + if (zoom !== undefined && center) { return previewBackend.getImage(mapConfigProvider, format, width, height, zoom, center, (err, image, headers, stats) => { From 7f5e65573018be60bbfbbccc87539e0130b40010 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Simon=20Mart=C3=ADn?= Date: Fri, 11 May 2018 17:45:17 +0200 Subject: [PATCH 4/6] static image format for last route --- lib/cartodb/api/map/preview-layergroup-controller.js | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/cartodb/api/map/preview-layergroup-controller.js b/lib/cartodb/api/map/preview-layergroup-controller.js index 5e9144c3..29cb11bc 100644 --- a/lib/cartodb/api/map/preview-layergroup-controller.js +++ b/lib/cartodb/api/map/preview-layergroup-controller.js @@ -67,6 +67,7 @@ module.exports = class PreviewLayergroupController { dbConnSetup(this.pgConnection), rateLimit(this.userLimitsBackend, RATE_LIMIT_ENDPOINTS_GROUPS.STATIC), cleanUpQueryParams(['layer']), + checkStaticImageFormat(), createMapStoreMapConfigProvider( this.mapStore, this.userLimitsBackend, From ad4ed7a06b3ce23971aeb68f7c4f1e1d3757ba48 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Simon=20Mart=C3=ADn?= Date: Fri, 11 May 2018 17:47:47 +0200 Subject: [PATCH 5/6] detail --- lib/cartodb/api/map/preview-template-controller.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/cartodb/api/map/preview-template-controller.js b/lib/cartodb/api/map/preview-template-controller.js index b0359e69..1a292ddb 100644 --- a/lib/cartodb/api/map/preview-template-controller.js +++ b/lib/cartodb/api/map/preview-template-controller.js @@ -255,7 +255,7 @@ function getImage({ previewBackend, label }) { height = +height; const format = req.params.format === 'jpg' ? 'jpeg' : 'png'; - + if (zoom !== undefined && center) { return previewBackend.getImage(mapConfigProvider, format, width, height, zoom, center, (err, image, headers, stats) => { From 56aa1b39f008d82edcc7a4c2bcf1ab03abd0af51 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Simon=20Mart=C3=ADn?= Date: Wed, 16 May 2018 12:00:40 +0200 Subject: [PATCH 6/6] removing 'jpeg' as valid format and no checking agains lowercase --- lib/cartodb/api/middlewares/check-static-image-format.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/cartodb/api/middlewares/check-static-image-format.js b/lib/cartodb/api/middlewares/check-static-image-format.js index d72fcb81..9b9c8b24 100644 --- a/lib/cartodb/api/middlewares/check-static-image-format.js +++ b/lib/cartodb/api/middlewares/check-static-image-format.js @@ -1,8 +1,8 @@ -const VALID_IMAGE_FORMATS = ['png', 'jpg', 'jpeg']; +const VALID_IMAGE_FORMATS = ['png', 'jpg']; module.exports = function checkStaticImageFormat () { return function checkStaticImageFormatMiddleware (req, res, next) { - if(!VALID_IMAGE_FORMATS.includes(req.params.format.toLowerCase())) { + if(!VALID_IMAGE_FORMATS.includes(req.params.format)) { return next(new Error(`Unsupported image format "${req.params.format}"`)); }