Merge pull request #1193 from hmhealey/plt798

PLT-798 Prevent image files larger than 4k resolution from being uploaded

2 files changed, 29 insertions, 5 deletions

diff --git a/api/file.go b/api/file.go
index 94eea516a..f65be145d 100644
--- a/api/file.go
+++ b/api/file.go
@@ -52,6 +52,8 @@ const (
 	RotatedCCW         = 6
 	RotatedCCWMirrored = 7
 	RotatedCW          = 8
+
+	MaxImageSize = 4096 * 2160 // 4k resolution
 )
 
 var fileInfoCache *utils.Cache = utils.NewLru(1000)
@@ -125,6 +127,21 @@ func uploadFile(c *Context, w http.ResponseWriter, r *http.Request) {
 
 		uid := model.NewId()
 
+		if model.IsFileExtImage(filepath.Ext(files[i].Filename)) {
+			imageNameList = append(imageNameList, uid+"/"+filename)
+			imageDataList = append(imageDataList, buf.Bytes())
+
+			// Decode image config first to check dimensions before loading the whole thing into memory later on
+			config, _, err := image.DecodeConfig(bytes.NewReader(buf.Bytes()))
+			if err != nil {
+				c.Err = model.NewAppError("uploadFile", "Unable to upload image file.", err.Error())
+				return
+			} else if config.Width*config.Height > MaxImageSize {
+				c.Err = model.NewAppError("uploadFile", "Unable to upload image file. File is too large.", err.Error())
+				return
+			}
+		}
+
 		path := "teams/" + c.Session.TeamId + "/channels/" + channelId + "/users/" + c.Session.UserId + "/" + uid + "/" + filename
 
 		if err := writeFile(buf.Bytes(), path); err != nil {
@@ -132,11 +149,6 @@ func uploadFile(c *Context, w http.ResponseWriter, r *http.Request) {
 			return
 		}
 
-		if model.IsFileExtImage(filepath.Ext(files[i].Filename)) {
-			imageNameList = append(imageNameList, uid+"/"+filename)
-			imageDataList = append(imageDataList, buf.Bytes())
-		}
-
 		encName := utils.UrlEncode(filename)
 
 		fileUrl := "/" + channelId + "/" + c.Session.UserId + "/" + uid + "/" + encName
diff --git a/api/user.go b/api/user.go
index 06e5336f1..3796a50ee 100644
--- a/api/user.go
+++ b/api/user.go
@@ -855,6 +855,18 @@ func uploadProfileImage(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// Decode image config first to check dimensions before loading the whole thing into memory later on
+	config, _, err := image.DecodeConfig(file)
+	if err != nil {
+		c.Err = model.NewAppError("uploadProfileFile", "Could not decode profile image config.", err.Error())
+		return
+	} else if config.Width*config.Height > MaxImageSize {
+		c.Err = model.NewAppError("uploadProfileFile", "Unable to upload profile image. File is too large.", err.Error())
+		return
+	}
+
+	file.Seek(0, 0)
+
 	// Decode image into Image object
 	img, _, err := image.Decode(file)
 	if err != nil {