From e86e51f06f6607698887623f29b09641a905cd85 Mon Sep 17 00:00:00 2001 From: Steven H Date: Mon, 30 Dec 2024 14:41:54 +0000 Subject: [PATCH] Fix an issue where the redirects of potentially malicious images were not going through. (#2666) --- .changeset/fuzzy-crabs-argue.md | 5 +++++ packages/gitbook/src/app/(global)/~gitbook/image/route.ts | 6 +++--- 2 files changed, 8 insertions(+), 3 deletions(-) create mode 100644 .changeset/fuzzy-crabs-argue.md diff --git a/.changeset/fuzzy-crabs-argue.md b/.changeset/fuzzy-crabs-argue.md new file mode 100644 index 000000000..91252d1a8 --- /dev/null +++ b/.changeset/fuzzy-crabs-argue.md @@ -0,0 +1,5 @@ +--- +'gitbook': minor +--- + +Fix an issue where the redirects of potentially malicious images were not going through. diff --git a/packages/gitbook/src/app/(global)/~gitbook/image/route.ts b/packages/gitbook/src/app/(global)/~gitbook/image/route.ts index 99a1db12b..f96d0bc90 100644 --- a/packages/gitbook/src/app/(global)/~gitbook/image/route.ts +++ b/packages/gitbook/src/app/(global)/~gitbook/image/route.ts @@ -1,4 +1,4 @@ -import { NextRequest } from 'next/server'; +import { NextRequest, NextResponse } from 'next/server'; import { CURRENT_SIGNATURE_VERSION, @@ -45,7 +45,7 @@ export async function GET(request: NextRequest) { } if (signatureVersion !== CURRENT_SIGNATURE_VERSION) { - return Response.redirect(url, 302); + return NextResponse.redirect(url, 302); } // Cloudflare-specific options are in the cf object. @@ -92,7 +92,7 @@ export async function GET(request: NextRequest) { return response; } catch (error) { // Redirect to the original image if resizing fails - return Response.redirect(url, 302); + return NextResponse.redirect(url, 302); } }