[PR #101] [MERGED] fix: validate image optimization content types and width bounds #310

New issue

Closed

opened 2026-05-06 12:39:06 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-06 12:39:06 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/cloudflare/vinext/pull/101
Author: @southpolesteve
Created: 2/26/2026
Status: ✅ Merged
Merged: 2/26/2026
Merged by: @southpolesteve

Base: main ← Head: fix/image-optimization-hardening

📝 Commits (1)

b40af33 fix: validate image optimization content types and width bounds

📊 Changes

8 files changed (+386 additions, -27 deletions)

View changed files

📝 examples/benchmarks/worker/index.ts (+2 -1)
📝 packages/vinext/src/config/next-config.ts (+4 -0)
📝 packages/vinext/src/deploy.ts (+6 -4)
📝 packages/vinext/src/index.ts (+13 -0)
📝 packages/vinext/src/server/image-optimization.ts (+100 -4)
📝 packages/vinext/src/server/prod-server.ts (+49 -13)
📝 packages/vinext/src/shims/image.tsx (+10 -3)
📝 tests/shims.test.ts (+202 -2)

📄 Description

Summary

Add Content-Security-Policy, X-Content-Type-Options, and Content-Disposition headers to all image optimization responses
Validate source Content-Type against an allowlist of safe image types (rejects SVG, HTML, and non-image types)
Bound the width parameter to configured deviceSizes/imageSizes with an absolute max of 3840px
Add images.deviceSizes and images.imageSizes to the NextConfig type
Make RESPONSIVE_WIDTHS in the image shim configurable via images.deviceSizes
Apply to all image optimization code paths: Cloudflare Workers, Node.js prod server (App Router + Pages Router)
Fix benchmarks limit query param NaN handling and lower bound

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/cloudflare/vinext/pull/101 **Author:** [@southpolesteve](https://github.com/southpolesteve) **Created:** 2/26/2026 **Status:** ✅ Merged **Merged:** 2/26/2026 **Merged by:** [@southpolesteve](https://github.com/southpolesteve) **Base:** `main` ← **Head:** `fix/image-optimization-hardening` --- ### 📝 Commits (1) - [`b40af33`](https://github.com/cloudflare/vinext/commit/b40af331263c4d5256b8adbec09eb3956a043f84) fix: validate image optimization content types and width bounds ### 📊 Changes **8 files changed** (+386 additions, -27 deletions) <details> <summary>View changed files</summary> 📝 `examples/benchmarks/worker/index.ts` (+2 -1) 📝 `packages/vinext/src/config/next-config.ts` (+4 -0) 📝 `packages/vinext/src/deploy.ts` (+6 -4) 📝 `packages/vinext/src/index.ts` (+13 -0) 📝 `packages/vinext/src/server/image-optimization.ts` (+100 -4) 📝 `packages/vinext/src/server/prod-server.ts` (+49 -13) 📝 `packages/vinext/src/shims/image.tsx` (+10 -3) 📝 `tests/shims.test.ts` (+202 -2) </details> ### 📄 Description ## Summary - Add Content-Security-Policy, X-Content-Type-Options, and Content-Disposition headers to all image optimization responses - Validate source Content-Type against an allowlist of safe image types (rejects SVG, HTML, and non-image types) - Bound the width parameter to configured `deviceSizes`/`imageSizes` with an absolute max of 3840px - Add `images.deviceSizes` and `images.imageSizes` to the NextConfig type - Make `RESPONSIVE_WIDTHS` in the image shim configurable via `images.deviceSizes` - Apply to all image optimization code paths: Cloudflare Workers, Node.js prod server (App Router + Pages Router) - Fix benchmarks `limit` query param NaN handling and lower bound --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>