Problem/Motivation

When Drupal try to generate webp derivative from an image search for filename with some extensions on uppercase first and then in lowercase. When we have on files two files like image.png and image.PNG or something similiar webp will find first image.PNG and if we have the other one in the content Drupal will generate a different token for that image and it will return a 403 error.

Steps to reproduce

  1. Install a clean Drupal installation
  2. Activate responsive_image
  3. Add webp module and enable it
  4. Create a content type and add an image field on it with responsive image display
  5. Create a test content and upload an image like image.png
  6. Create another test content and upload an image like image.PNG
  7. Execute drush if --all and drush cr to clean caches
  8. Reload first content and check that the image is not regenerated

Proposed resolution

On deliver method from ImageStyleDownloadController try to detect this case.

Issue fork webp-3189967

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

abarrio created an issue. See original summary.

abarrio’s picture

Hi all,

I have fixed it with this patch. I just try to detect that case on token check to return valid path for the generation.

luksak’s picture

I am experiencing a similar, but slightly diffrerent issue: if two files have the same file name, but a different extension, I also get a 404 error. Eg:

  • test.jpg
  • test.png

Should I open a second issue or could we handle this in this one as well?

abarrio’s picture

Hi Lukas
I think we can handle that in this issue.
Can you add steps to reproduce the problem?

luksak’s picture

@abarrio great. sure, I'll try to provide them later today.

Webbeh’s picture

Given the work of #3186383: Access Denied on WebP images with Image Optimize API (see patch in #10), can y'all see if that patch solves the issue here as well? If so, we may want to close this as a duplicate issue.

luksak’s picture

I was unable to reproduce my issue on a clean install. The patch in #3186383: Access Denied on WebP images with Image Optimize API doesn't resolve it either.

This is the error I get in the logs:

Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException: in Drupal\webp\Controller\ImageStyleDownloadController->deliver() (line 174 of /app/web/modules/contrib/webp/src/Controller/ImageStyleDownloadController.php).

I tried downloading the source image an re-upoad it, which fixed the issue with that particular image. What could I do to debug this?

My issue is solved, but this not what this issue is actually about. I actually am having trouble to reproduce the issue at all. The images are being displayed correctly with different cased file extensions

luksak’s picture

Status: Needs review » Postponed (maintainer needs more info)
luksak’s picture

Status: Postponed (maintainer needs more info) » Active

Actually... My last comment was only regarding my issue, not regarding upper- and lowercase file names.

bember’s picture

@Lukas von Blarer@ I'm experiencing issue you described. Here are the steps to replicate it (pretty analogous to the ticket description):

  1. Install a clean Drupal installation
  2. Activate responsive_image
  3. Add webp module and enable it
  4. Create a content type and add an image field on it with responsive image display
  5. Create a test content and upload an image like image.png
  6. Create another test content and upload an image like image.jpg (make sure that this image looks different from the previous one)
  7. Execute drush if --all and drush cr to clean caches
  8. Reload the 2nd content and check that the image is not regenerated

Now here's another issue - continuing the steps:

  1. Reload 1st content - you should see that the image displays correctly
  2. Go back to the 2nd content and check that the image from the 1st content is showing instead

This looks like a major issue to me. I'm attaching a patch that disambiguates the WebP files by including the extension into the file name (e.g. image.png.webp, image.jpg.webp). That should fix it.

re @Webbeh: at first glance it seems that patch #10 from #3186383: Access Denied on WebP images with Image Optimize API solves the upper/lower case issue, but I didn't have time to test it.

bember’s picture

Status: Active » Needs review

Marking this as "needs review".

bember’s picture

I just realized that #10 fixes the upper/lower case issue too. Adding the original extension to the webp filename handles well ambiguities such as image.png vs image.PNG, since the resulting webp files in that case are image.png.webp and image.PNG.webp - which means no naming conflicts. I ran some tests and it looks good.

bember’s picture

Here's the updated patch with unit test and documentation fixes.

bember’s picture

Whoops, I accidentally included packaging info into the previous patch.

greggles’s picture

Moving to https://security.drupal.org/node/174524#new

If you need access to that, mail security@drupal.org and ask.

greggles’s picture

nanobyt3’s picture

Hi!
When is it planned to release this fix into beta or stable release

Webbeh’s picture

This is marked Needs Review, so it'll need Review that the supplied patch works and applies cleanly, then a move to RTBC for community approval, pending fix or feedback by a maintainer.

Right now, having folks confirm the supplied patch fixes the issue can help us move to RTBC.

alexmoreno’s picture

src/Webp.php has been refactored, which means this patch does not apply anymore

alexmoreno’s picture

Status: Needs review » Needs work
alexmoreno’s picture

if someone could confirm, I think this is fixed already in this issue: https://www.drupal.org/project/webp/issues/3210821

I'll mark for now duplicated, but if confirmed it would be already fixed. Otherwise please re-submit a working patch.

Thanks a lot

dj1999’s picture

@alexmoreno in Jan 15. 2022 prepared this commit https://git.drupalcode.org/project/webp/-/commit/33fb22624108c6c6d173a20....
Just this row is different to working properly this issue:
public function getWebpSrcset($srcset) {
return preg_replace('/\.(png|jpg|jpeg)(\\?.*?)?(,| |$)/i', '.\\1.webp\\2\\3', $srcset);
}

Unfortunately this is not true. Randomly prepare broken image.

dj1999’s picture

alexmoreno’s picture

thanks @dj1999. Apologies but I did not understand your message. Do you mean the issue is still there?

Thanks.

dj1999’s picture

@alexmoreno we testing with different images same name and different extension (eg.: foo.jpg and foo.jpeg). Without patch #23 display the two image in site will show the first image two time. With patch #23 will show randomly the images if reload page and often got broken image.

alexmoreno’s picture

got it @greggles, thanks for the patience.

So neither the issue is fixed, neither it gets fixed with the patch.

The use case is different though, as the title mentions that is regarding lower case/upper case, but happy to keep it open as long as we can track both issues (as they seem very related to me)

tdroden’s picture

@alexmoreno while it is a similar looking error, https://www.drupal.org/project/webp/issues/3210821 has not fixed this issue which still remains in Beta6 for me.

This case-sensitivity seems to be popping up as the root cause of a number of things. https://www.drupal.org/project/webp/issues/3186383 seems to be the farthest along towards a working patch.