Problem/Motivation
Image structure builders accept a $styleName argument and pass it straight through (for example the blog_teaser default). If the style does not exist on the site, the code either fails or silently returns the original file URL, which can serve full-size images to the frontend.
Proposed resolution
- Load the image style through the entity type manager and verify it exists before generating a URL.
- Log a warning and fall back to the original URL deliberately rather than by accident.
- Make the default style names configurable rather than hardcoded.
Remaining tasks
Audit every image-building method and add the validation.
User interface changes
Configurable default image styles.
API changes
None.
Issue fork myrest-3616440
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
Comments
Comment #4
sergeydruua commentedComment #6
sergeydruua commented