Skip to content

fix(security): remplacer base64-img#488

Merged
elias75015 merged 5 commits intomainfrom
fix/security-base64
Mar 9, 2026
Merged

fix(security): remplacer base64-img#488
elias75015 merged 5 commits intomainfrom
fix/security-base64

Conversation

@lowzonenose
Copy link
Copy Markdown
Collaborator

Remplacer base64-img par une lecture/encodage natif pour améliorer la sécurité

cf. issue #447

L'encodage base64 est réalisé via la commande : npm run publish

Elle permet de convertir les images en base64 dans les CSS.

Comment tester ?

  • builder et publier les extensions
  • voir si des images ne sont pas cassées (ex. dans cartes.gouv.fr ou les projets demos)

@lowzonenose lowzonenose self-assigned this Feb 12, 2026
@lowzonenose lowzonenose linked an issue Feb 12, 2026 that may be closed by this pull request
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR replaces the base64-img package with native Node.js file reading and base64 encoding to improve security, addressing issue #447.

Changes:

  • Removed the base64-img dependency from package.json
  • Implemented native base64 encoding using Node.js fs and Buffer APIs in the build script

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File Description
package.json Removed the base64-img dependency
build/release/package.js Replaced base64-img.base64Sync() with native file reading and base64 encoding, including MIME type detection

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread build/release/package.js
case '.svg': return 'image/svg+xml';
case '.gif': return 'image/gif';
case '.webp': return 'image/webp';
default: return 'application/octet-stream';
Copy link

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The fallback MIME type 'application/octet-stream' for unsupported image formats may cause issues with CSS url() declarations. Consider either throwing an error for unsupported formats or logging a warning to alert developers when an unexpected file type is encountered.

Suggested change
default: return 'application/octet-stream';
default:
console.warn(`[package] Unsupported image format '${ext}' for file '${url}'. Falling back to 'application/octet-stream'.`);
return 'application/octet-stream';

Copilot uses AI. Check for mistakes.
@elias75015
Copy link
Copy Markdown
Contributor

IGNF/cartes.gouv.fr-entree-carto#962 --> Pour tester côté entrée carto

OK pour moi, je n'ai rien vu de cassé

@elias75015 elias75015 merged commit 42ea1f5 into main Mar 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Vulnérabilité lodash.template

3 participants