@@ -11,6 +11,7 @@ namespace NodeServicesExamples.Controllers
1111 public class ResizeImageController : Controller
1212 {
1313 private const int MaxDimension = 1000;
14+ private static string[] AllowedMimeTypes = new[] { "image/jpeg", "image/png", "image/gif" };
1415
1516 private IHostingEnvironment _environment;
1617 private INodeServices _nodeServices;
@@ -25,11 +26,18 @@ public ResizeImageController(IHostingEnvironment environment, INodeServices node
2526 public async Task<IActionResult> Index(string imagePath, int maxWidth, int maxHeight)
2627 {
2728 // Validate incoming params
28- if (maxWidth > MaxDimension || maxHeight > MaxDimension || (maxHeight <= 0 && maxWidth <= 0))
29+ if (maxWidth < 0 || maxHeight < 0 || maxWidth > MaxDimension || maxHeight > MaxDimension
30+ || (maxWidth + maxHeight) == 0)
2931 {
3032 return BadRequest("Invalid dimensions");
3133 }
3234
35+ var mimeType = GetContentType(imagePath);
36+ if (Array.IndexOf(AllowedMimeTypes, mimeType) < 0)
37+ {
38+ return BadRequest("Disallowed image format");
39+ }
40+
3341 // Locate source image on disk
3442 var fileInfo = _environment.WebRootFileProvider.GetFileInfo(imagePath);
3543 if (!fileInfo.Exists)
@@ -38,25 +46,19 @@ public async Task<IActionResult> Index(string imagePath, int maxWidth, int maxHe
3846 }
3947
4048 // Invoke Node and pipe the result to the response
41- var mimeType = GetContentType(imagePath);
42- var imageStream = await _nodeServices.Invoke<Stream>("./Node/resizeImage", fileInfo.PhysicalPath, mimeType, maxWidth, maxHeight);
49+ var imageStream = await _nodeServices.Invoke<Stream>(
50+ "./Node/resizeImage",
51+ fileInfo.PhysicalPath,
52+ mimeType,
53+ maxWidth,
54+ maxHeight);
4355 return File(imageStream, mimeType);
4456 }
4557
4658 private string GetContentType(string path)
4759 {
4860 string result;
49- if (!new FileExtensionContentTypeProvider().TryGetContentType(path, out result))
50- {
51- result = "application/octet-stream";
52- }
53-
54- return result;
55- }
56-
57- private class ResizeImageResult
58- {
59- public string Base64 { get; set; }
61+ return new FileExtensionContentTypeProvider().TryGetContentType(path, out result) ? result : null;
6062 }
6163 }
6264}
0 commit comments