[storage-resize-images] contentType gate lets unsupported formats reach libvips loaders; published 0.3.6 bundles sharp 0.34.5 behind three sharp advisories #3246

[READ] Step 1: Are you in the right place?

Yes: this is about storage-resize-images in this repository.

[REQUIRED] Step 2: Describe your configuration

• Extension name: storage-resize-images
• Extension version: 0.3.6 (Hub install ref firebase/[email protected], source commit 1ac8343); next at 300a93f is affected as well
• Configuration values (redact info where appropriate):
  • defaults (IMG_SIZES=200x200, original image type kept, content filter off)
  • any watched bucket or path that accepts end-user uploads

[REQUIRED] Step 3: Describe the problem

Problem. shouldResize() (functions/src/filters.ts) admits an object when its contentType is in supportedContentTypes. That value is object metadata the uploader sets. libvips then picks the loader from the file bytes, so an SVG uploaded as image/png passes the gate and is parsed by librsvg, a format this extension does not list as supported (#1230, #1947).

The decoders bundled with the published version are behind three sharp advisories:

Published 0.3.6 resolves sharp 0.34.5 (libvips 8.17.3, libheif 1.20.2, librsvg 2.61.2). next at 0.35.3 still carries the last two. resize() also passes failOnError: false on every decode.

Steps to reproduce:

Local, extension code only. Save a plain SVG as probe.png; shouldResize({contentType: "image/png", ...}) returns true; resize(file, "200x200") succeeds and sharp(file).metadata().format is svg; with sharp.block({operation: ["VipsForeignLoadSvg"]}) the same call fails with "unsupported image format". On sharp 0.34.5 the same pipeline decodes avif/gif/tiff through the heif/nsgif/tiff loaders.

Expected result

A file is decoded only by a loader for one of the supported content types, with decoder versions that carry the current sharp security fixes.

Actual result

Any decodable file reaches the loader for its real format regardless of the declared type, at library versions with published memory-safety advisories.

Fix. Bump sharp to ^0.35.5 and block the VipsForeignLoad base class at module load, re-enabling only the loaders for supportedContentTypes (Jpeg, Png, Tiff, Webp, Nsgif, Heif). Branch with the change and a regression test: https://github.com/cybrdude/extensions/tree/resize-images-sharp-0.35.5; PR follows.

Also reported through the channels in SECURITY.md (Google VRP b/574386863, advisory GHSA-pvx3-hg35-5vwm); filing here per CONTRIBUTING.md because the dependency advisories are public and the fix is a dependency bump plus a loader allowlist.