Problem/Motivation

Image structure builders accept a $styleName argument and pass it straight through (for example the blog_teaser default). If the style does not exist on the site, the code either fails or silently returns the original file URL, which can serve full-size images to the frontend.

Proposed resolution

  • Load the image style through the entity type manager and verify it exists before generating a URL.
  • Log a warning and fall back to the original URL deliberately rather than by accident.
  • Make the default style names configurable rather than hardcoded.

Remaining tasks

Audit every image-building method and add the validation.

User interface changes

Configurable default image styles.

API changes

None.

Issue fork myrest-3616440

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

sergeydruua created an issue. See original summary.

  • sergeydruua committed 535f39ba on 1.0.x
    Issue #3616440: Validate image style names before building derivative...
sergeydruua’s picture

Status: Active » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

sergeydruua’s picture

Status: Fixed » Closed (fixed)