Implement limits to image size and load times (#1790)

* Implement limits to image size and load times
 - Prevents issues caused by users attempting to load large images
 - Implements #1729

* Check dimensions given before attempting to load image
This commit is contained in:
Jordan 2022-06-13 08:04:59 +01:00 committed by GitHub
parent 8377b0987c
commit 02a6bb9b27
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 49 additions and 9 deletions

View File

@ -647,16 +647,21 @@ public class Settings extends Config {
} }
@Comment({"Web/HTTP connection related settings"})
public static class WEB { public static class WEB {
@Comment({ @Comment({"The web interface for clipboards", " - All schematics are anonymous and private", " - Downloads can be deleted by the user", " - Supports clipboard uploads, downloads and saves",})
"The web interface for clipboards",
" - All schematics are anonymous and private",
" - Downloads can be deleted by the user",
" - Supports clipboard uploads, downloads and saves",
})
public String URL = "https://schem.intellectualsites.com/fawe/"; public String URL = "https://schem.intellectualsites.com/fawe/";
@Comment("The maximum amount of time in seconds the plugin can attempt to load images for.")
public int MAX_IMAGE_LOAD_TIME = 5;
@Comment({
"The maximum size (width x length) an image being loaded can be.",
" - 8294400 is 3840x2160"
})
public int MAX_IMAGE_SIZE = 8294400;
} }
public static class EXTENT { public static class EXTENT {

View File

@ -4,6 +4,7 @@ import com.fastasyncworldedit.core.Fawe;
import com.fastasyncworldedit.core.configuration.Caption; import com.fastasyncworldedit.core.configuration.Caption;
import com.fastasyncworldedit.core.configuration.Settings; import com.fastasyncworldedit.core.configuration.Settings;
import com.fastasyncworldedit.core.history.changeset.FaweStreamChangeSet; import com.fastasyncworldedit.core.history.changeset.FaweStreamChangeSet;
import com.fastasyncworldedit.core.internal.exception.FaweException;
import com.fastasyncworldedit.core.internal.io.AbstractDelegateOutputStream; import com.fastasyncworldedit.core.internal.io.AbstractDelegateOutputStream;
import com.fastasyncworldedit.core.internal.io.FaweInputStream; import com.fastasyncworldedit.core.internal.io.FaweInputStream;
import com.fastasyncworldedit.core.internal.io.FaweOutputStream; import com.fastasyncworldedit.core.internal.io.FaweOutputStream;
@ -532,6 +533,8 @@ public class MainUtil {
public static BufferedImage toRGB(BufferedImage src) { public static BufferedImage toRGB(BufferedImage src) {
if (src == null) { if (src == null) {
return src; return src;
} else if ((long) src.getWidth() * src.getHeight() > Settings.settings().WEB.MAX_IMAGE_SIZE) {
throw new FaweException(Caption.of("fawe.web.image.load.size.too-large", Settings.settings().WEB.MAX_IMAGE_SIZE));
} }
BufferedImage img = new BufferedImage(src.getWidth(), src.getHeight(), BufferedImage.TYPE_INT_ARGB); BufferedImage img = new BufferedImage(src.getWidth(), src.getHeight(), BufferedImage.TYPE_INT_ARGB);
Graphics2D g2d = img.createGraphics(); Graphics2D g2d = img.createGraphics();

View File

@ -21,7 +21,9 @@ package com.sk89q.worldedit.command;
import com.fastasyncworldedit.core.Fawe; import com.fastasyncworldedit.core.Fawe;
import com.fastasyncworldedit.core.configuration.Caption; import com.fastasyncworldedit.core.configuration.Caption;
import com.fastasyncworldedit.core.configuration.Settings;
import com.fastasyncworldedit.core.function.generator.CavesGen; import com.fastasyncworldedit.core.function.generator.CavesGen;
import com.fastasyncworldedit.core.internal.exception.FaweException;
import com.fastasyncworldedit.core.util.MainUtil; import com.fastasyncworldedit.core.util.MainUtil;
import com.fastasyncworldedit.core.util.MaskTraverser; import com.fastasyncworldedit.core.util.MaskTraverser;
import com.fastasyncworldedit.core.util.MathMan; import com.fastasyncworldedit.core.util.MathMan;
@ -65,6 +67,11 @@ import java.awt.image.BufferedImage;
import java.io.IOException; import java.io.IOException;
import java.net.URL; import java.net.URL;
import java.util.List; import java.util.List;
import java.util.concurrent.ExecutorService;
import java.util.concurrent.Executors;
import java.util.concurrent.Future;
import java.util.concurrent.TimeUnit;
import java.util.concurrent.TimeoutException;
import static com.google.common.base.Preconditions.checkNotNull; import static com.google.common.base.Preconditions.checkNotNull;
import static com.sk89q.worldedit.command.util.Logging.LogMode.ALL; import static com.sk89q.worldedit.command.util.Logging.LogMode.ALL;
@ -587,12 +594,34 @@ public class GenerationCommands {
if (!url.getHost().equalsIgnoreCase("i.imgur.com")) { if (!url.getHost().equalsIgnoreCase("i.imgur.com")) {
throw new IOException("Only i.imgur.com links are allowed!"); throw new IOException("Only i.imgur.com links are allowed!");
} }
BufferedImage image = MainUtil.readImage(url);
if (dimensions != null) { if (dimensions != null) {
image = ImageUtil.getScaledInstance(image, dimensions.getBlockX(), dimensions.getBlockZ(), checkCommandArgument(
RenderingHints.VALUE_INTERPOLATION_BILINEAR, false (long) dimensions.getX() * dimensions.getZ() <= Settings.settings().WEB.MAX_IMAGE_SIZE,
Caption.of("fawe.error.image-dimensions", Settings.settings().WEB.MAX_IMAGE_SIZE)
); );
} }
ExecutorService executor = Executors.newSingleThreadExecutor();
Future<BufferedImage> future = executor.submit(() -> {
BufferedImage image = MainUtil.readImage(url);
if (dimensions != null) {
image = ImageUtil.getScaledInstance(image, dimensions.getBlockX(), dimensions.getBlockZ(),
RenderingHints.VALUE_INTERPOLATION_BILINEAR, false
);
}
return image;
});
BufferedImage image;
try {
image = future.get(Settings.settings().WEB.MAX_IMAGE_LOAD_TIME, TimeUnit.SECONDS);
} catch (InterruptedException | TimeoutException ignored) {
actor.printError(Caption.of("fawe.web.image.load.timeout", Settings.settings().WEB.MAX_IMAGE_LOAD_TIME));
return;
} catch (Throwable t) {
if (t.getCause() instanceof FaweException faweException) {
throw faweException;
}
throw new IOException(t.getCause());
}
BlockVector3 pos1 = session.getPlacementPosition(actor); BlockVector3 pos1 = session.getPlacementPosition(actor);
BlockVector3 pos2 = pos1.add(image.getWidth() - 1, 0, image.getHeight() - 1); BlockVector3 pos2 = pos1.add(image.getWidth() - 1, 0, image.getHeight() - 1);

View File

@ -17,6 +17,8 @@
"fawe.web.generating.link": "Uploading {0}, please wait...", "fawe.web.generating.link": "Uploading {0}, please wait...",
"fawe.web.generating.link.failed": "Failed to generate download link!", "fawe.web.generating.link.failed": "Failed to generate download link!",
"fawe.web.download.link": "{0}", "fawe.web.download.link": "{0}",
"fawe.web.image.load.timeout": "Image load attempt timed out, max time: {0}s. Please try a smaller-resolution image.",
"fawe.web.image.load.size.too-large": "Image dimensions too large! Max allowable size (width x height): {0} pixels.",
"fawe.worldedit.general.texture.disabled": "Texturing reset", "fawe.worldedit.general.texture.disabled": "Texturing reset",
"fawe.worldedit.general.texture.set": "Set texturing to {1}", "fawe.worldedit.general.texture.set": "Set texturing to {1}",
"fawe.worldedit.general.source.mask.disabled": "Global source mask disabled", "fawe.worldedit.general.source.mask.disabled": "Global source mask disabled",
@ -104,6 +106,7 @@
"fawe.error.radius-too-small": "Radius must be >=0", "fawe.error.radius-too-small": "Radius must be >=0",
"fawe.error.time-too-less": "Time must be >=0", "fawe.error.time-too-less": "Time must be >=0",
"fawe.error.invalid-image": "Invalid image: {0}", "fawe.error.invalid-image": "Invalid image: {0}",
"fawe.error.image-dimensions": "Dimensions given for image too large, max allowable size (width x height): {0} pixels.",
"fawe.error.file-not-found": "File not found: {0}", "fawe.error.file-not-found": "File not found: {0}",
"fawe.error.file-is-invalid-directory": "File is a directory: {0}", "fawe.error.file-is-invalid-directory": "File is a directory: {0}",
"fawe.error.stacktrace": "===============---=============", "fawe.error.stacktrace": "===============---=============",