From 0eacf6f2c2ab3f10a28cb0baedf52cfd2802b194 Mon Sep 17 00:00:00 2001 From: Leendert de Borst Date: Sun, 2 Aug 2026 19:25:31 +0200 Subject: [PATCH] Add max response limit to favicon extractor (#2310) --- .../Utilities/AliasVault.FaviconExtractor/FaviconExtractor.cs | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/apps/server/Utilities/AliasVault.FaviconExtractor/FaviconExtractor.cs b/apps/server/Utilities/AliasVault.FaviconExtractor/FaviconExtractor.cs index 3e51ab8f5..9e1aa8abf 100644 --- a/apps/server/Utilities/AliasVault.FaviconExtractor/FaviconExtractor.cs +++ b/apps/server/Utilities/AliasVault.FaviconExtractor/FaviconExtractor.cs @@ -26,6 +26,7 @@ using SkiaSharp; public static class FaviconExtractor { private const int MaxSizeBytes = 20 * 1024; // 20KB max size; images above this are resized/re-encoded. + private const int MaxResponseBytes = 5 * 1024 * 1024; // 5MB cap per response body, measured after decompression. private static readonly int[] _resizeWidths = [96, 64, 48, 32]; private static readonly int[] _jpegFallbackQualities = [80, 65, 50]; private static readonly string[] _allowedSchemes = ["http", "https"]; @@ -441,7 +442,8 @@ public static class FaviconExtractor var client = new HttpClient(handler) { - Timeout = TimeSpan.FromSeconds(5), // Keep original timeout + Timeout = TimeSpan.FromSeconds(5), + MaxResponseContentBufferSize = MaxResponseBytes, }; var random = new Random();