Merge branch 'main' into mk/canary-demo

Author: ascorbic

.release-please-manifest.json

@@ -1,4 +1,4 @@
 {
-  "packages/runtime": "4.24.1",
+  "packages/runtime": "4.24.2",
   "packages/next": "1.3.1"
 }

package-lock.json

@@ -1,5 +1,12 @@
 # Changelog
 
+## [4.24.2](https://github.com/netlify/next-runtime/compare/plugin-nextjs-v4.24.1...plugin-nextjs-v4.24.2) (2022-10-05)
+
+
+### Bug Fixes
+
+* validate next/image params ([#1661](https://github.com/netlify/next-runtime/issues/1661)) ([c0937cf](https://github.com/netlify/next-runtime/commit/c0937cf67e84d5e14c99670910ac33fc2dd0e166))
+
 ## [4.24.1](https://github.com/netlify/next-runtime/compare/plugin-nextjs-v4.24.0...plugin-nextjs-v4.24.1) (2022-10-05)
 
 

packages/runtime/CHANGELOG.md

@@ -1,6 +1,6 @@
 {
   "name": "@netlify/plugin-nextjs",
-  "version": "4.24.1",
+  "version": "4.24.2",
   "description": "Run Next.js seamlessly on Netlify",
   "main": "lib/index.js",
   "files": [
@@ -12,7 +12,7 @@
   "dependencies": {
     "@netlify/esbuild": "0.14.39",
     "@netlify/functions": "^1.3.0",
-    "@netlify/ipx": "^1.2.5",
+    "@netlify/ipx": "^1.3.0",
     "@vercel/node-bridge": "^2.1.0",
     "chalk": "^4.1.2",
     "destr": "^1.1.1",

packages/runtime/package.json

@@ -9,6 +9,9 @@ interface ImageConfig extends Record<string, unknown> {
   formats?: string[]
 }
 
+// Checks if a URL param is numeric
+const isNumeric = (value: string | null) => Number(value).toString() === value
+
 /**
  * Implement content negotiation for images
  */
@@ -28,10 +31,28 @@ const handler = async (req: Request, context: Context) => {
 
   const source = searchParams.get('url')
   const width = searchParams.get('w')
-  const quality = searchParams.get('q') ?? 75
+  const quality = searchParams.get('q') ?? '75'
+
+  const errors: Array<string> = []
+
+  if (!source) {
+    errors.push('Missing "url" parameter')
+  } else if (!source.startsWith('http') && !source.startsWith('/')) {
+    errors.push('The "url" parameter must be a valid URL or path')
+  }
+
+  if (!width) {
+    errors.push('Missing "w" parameter')
+  } else if (!isNumeric(width)) {
+    errors.push('Invalid "w" parameter')
+  }
+
+  if (!isNumeric(quality)) {
+    errors.push('Invalid "q" parameter')
+  }
 
-  if (!source || !width) {
-    return new Response('Invalid request', {
+  if (!source || errors.length > 0) {
+    return new Response(`Invalid request: \n${errors.join('\n')}`, {
       status: 400,
     })
   }

packages/runtime/src/templates/edge/ipx.ts

@@ -10,5 +10,6 @@ export const handler: Handler = createIPXHandler({
   domains,
   remotePatterns,
   responseHeaders,
+  localPrefix: '/_next/static/media/',
 }) as Handler
 /* eslint-enable n/no-missing-import, import/no-unresolved, @typescript-eslint/ban-ts-comment  */