/proxyでemoji, avatarなどの命令がありかつ画像でないなら404を返すように

1 files changed, 16 insertions, 8 deletions

diff --git a/packages/backend/src/server/FileServerService.ts b/packages/backend/src/server/FileServerService.ts
index 4bd6d0f556..49ded6c28e 100644
--- a/packages/backend/src/server/FileServerService.ts
+++ b/packages/backend/src/server/FileServerService.ts
@@ -255,8 +255,21 @@ export class FileServerService {
 			const isConvertibleImage = isMimeImage(file.mime, 'sharp-convertible-image');
 			const isAnimationConvertibleImage = isMimeImage(file.mime, 'sharp-animation-convertible-image');
 
+			if (
+				'emoji' in request.query ||
+				'avatar' in request.query ||
+				'static' in request.query ||
+				'preview' in request.query ||
+				'badge' in request.query
+			) {
+				if (!isConvertibleImage) {
+					// 画像でないなら404でお茶を濁す
+					throw new StatusError('Unexpected mime', 404);
+				}
+			}
+
 			let image: IImageStreamable | null = null;
-			if (('emoji' in request.query || 'avatar' in request.query) && isConvertibleImage) {
+			if ('emoji' in request.query || 'avatar' in request.query) {
 				if (!isAnimationConvertibleImage && !('static' in request.query)) {
 					image = {
 						data: fs.createReadStream(file.path),
@@ -277,16 +290,11 @@ export class FileServerService {
 						type: 'image/webp',
 					};
 				}
-			} else if ('static' in request.query && isConvertibleImage) {
+			} else if ('static' in request.query) {
 				image = this.imageProcessingService.convertToWebpStream(file.path, 498, 280);
-			} else if ('preview' in request.query && isConvertibleImage) {
+			} else if ('preview' in request.query) {
 				image = this.imageProcessingService.convertToWebpStream(file.path, 200, 200);
 			} else if ('badge' in request.query) {
-				if (!isConvertibleImage) {
-					// 画像でないなら404でお茶を濁す
-					throw new StatusError('Unexpected mime', 404);
-				}
-
 				const mask = sharp(file.path)
 					.resize(96, 96, {
 						fit: 'inside',