We should make sure that requests sent to the server are valid.

This patch is on top of #3070616: Various minor fixes.

CommentFileSizeAuthor
#3 client_hints_3070630_interdiff_1_3.txt642 bytesjan.stoeckler
#3 client_hints_3070630_3.patch4.27 KBjan.stoeckler
client-hints-request-validate.patch4.09 KBtstoeckler

Comments

tstoeckler created an issue. See original summary.

jan.stoeckler’s picture

jan.stoeckler
he/his
Primary language German
commented

Awesome! Should we also add a check for the existence of the actual image (file) or is that not a good idea? If not, why not? Thanks!

jan.stoeckler’s picture

jan.stoeckler
he/his
Primary language German
commented
StatusFileSize
new client_hints_3070630_3.patch4.27 KB
new client_hints_3070630_interdiff_1_3.txt642 bytes

This (#3) approach seems a bit naive and might potentially expose the existence of files that should not be exposed. Maybe add further checks for extension or mime-type of target file? Thankful for any guidance!