-
Notifications
You must be signed in to change notification settings - Fork 17
Closed
Description
Imagekit crashes with following example code, since the variable 'i' is used in 2 nested loops:
url.py :
@staticmethod
def transformation_to_str(transformation):
"""
creates transformation_position string for url from
transformation_position dictionary
"""
if not isinstance(transformation, list):
return ""
parsed_transforms = []
for i in range(len(transformation)):
parsed_transform_step = []
for key in transformation[i]:
transform_key = SUPPORTED_TRANS.get(key, "")
if not transform_key:
transform_key = key
if transformation[i][key] == "-":
parsed_transform_step.append(transform_key)
else:
value = transformation[i][key]
if isinstance(value, bool):
value = str(value).lower()
if transform_key == "oi" or transform_key == "di":
value = value.strip("/")
value = value.replace("/", "@@")
if transform_key == "raw":
for i in value.split(","): # HERE THE VALUE I IS OVERRIDDEN TO 'f-auto' AND WILL CRASH THE OUTTER LOOP
parsed_transform_step.append(i)
else:
parsed_transform_step.append(
"{}{}{}".format(
transform_key,
Default.TRANSFORM_KEY_VALUE_DELIMITER.value,
value,
)
)
parsed_transforms.append(
Default.TRANSFORM_DELIMITER.value.join(parsed_transform_step)
)
return Default.CHAIN_TRANSFORM_DELIMITER.value.join(parsed_transforms)
Example code to crash imagekit:
transformation = {}
transformation["raw"] = "f-auto" # If this is not given last, it will crash the imagekit library
if width is not None: transformation["width"] = width
if height is not None: transformation["height"] = height
# transformation["raw"] = file_type
imagekit_url = self._imagekit_client.url({
"url_endpoint": self._imagekit_base_url,
"path": f"/{file.file_name}",
"transformation": [
transformation
],
"signed": True,
"expire_seconds": expires_in,
"query_parameters": {
"ik-attachment": "true" if content_disposition == EnumContentDisposition.attachment else "false" # This is not fancy too since you need to pass strings instead of bools.
},
})
LucaPapay
Metadata
Metadata
Assignees
Labels
No labels