-
Notifications
You must be signed in to change notification settings - Fork 0
[#223] 웹페이지 썸네일에 대한 용량 처리를 개선한다 #224
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
073a395
d6e438f
91d2674
9b9a2fc
d6cb736
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -15,11 +15,7 @@ struct WebItemRow: View { | |
|
|
||
| var body: some View { | ||
| HStack { | ||
| CacheableImage(url: item.imageURL) { | ||
| Image(systemName: "globe") | ||
| .resizable() | ||
| .scaledToFit() | ||
| } | ||
| thumbnail | ||
| .frame(width: sceneWidth / 10, height: sceneWidth / 10) | ||
| .clipShape(RoundedRectangle(cornerRadius: 10)) | ||
|
|
||
|
|
@@ -41,4 +37,30 @@ struct WebItemRow: View { | |
| } | ||
| .padding(.vertical, 4) | ||
| } | ||
|
|
||
| @ViewBuilder | ||
| private var thumbnail: some View { | ||
| if let imageURL = item.imageURL { | ||
| AsyncImage(url: imageURL) { phase in | ||
|
Comment on lines
+43
to
+44
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. The |
||
| switch phase { | ||
| case .success(let image): | ||
| image | ||
| .resizable() | ||
| .scaledToFill() | ||
| case .empty: | ||
| ProgressView() | ||
| default: | ||
| placeholderImage | ||
| } | ||
| } | ||
| } else { | ||
| placeholderImage | ||
| } | ||
| } | ||
|
|
||
| private var placeholderImage: some View { | ||
| Image(systemName: "globe") | ||
| .resizable() | ||
| .scaledToFit() | ||
| } | ||
| } | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The
needsImageRestorefunction uses a URL from theWebPageResponse(which originates from a remote database, Firestore) to access local files. While it checks if the URL is a file URL (url.isFileURL), it does not verify that the URL points to the authorized cache directory. An attacker who can manipulate the Firestore data could provide a malicious file URL (e.g.,file:///etc/passwdor other sensitive paths), leading to a Local File Inclusion (LFI) vulnerability. Although the content is not directly leaked to the attacker in this specific function, it allows unauthorized access to local files and could be used as part of a larger exploit or to trigger crashes with malformed data.