Automattic / Automattic/jetpack

Photon: validate URLs passed to jetpack_photon_url() when used by third-parties

Open
#35,674 2 comments 0 reactions 0 assignees View on GitHub
[Feature] Photon [Package] Image CDN [Pri] Low Enhancement Good For Community
Dominant language
PHP
Stars
1.8k
Forks
898
Avg merge
1d 18h
Merged PRs (30d)
774

Description

### Impacted plugin

Jetpack

### Quick summary

The `jetpack_photon_url` filter photon-izes invalid URLs, for example with SVG extension.

This leads to broken images.

Also, there isn't an API function to validate image URLs.

While checking for supported extensions manually is possible, the list might change.

### Steps to reproduce

Pass a URL with an unsupported extension (for example svg, or avif) to the filter.

### A clear and concise description of what you expected to happen.

The `jetpack_photon_url` should return the original URL if the extension isn't supported.

### What actually happened

_No response_

### Impact

Some (< 50%)

### Available workarounds?

_No response_

### Platform (Simple and/or Atomic)

_No response_

### Logs or notes

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by tracing the jetpack_photon_url filter and its URL-extension validation path in Jetpack; the issue does not name a file or test. Reproduce with SVG or AVIF, then verify unsupported extensions return the original URL while supported image URLs remain photonized.

Written by the indexing model from the issue text.

Assessment

Tech stack
php, wordpress
Domain
backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.