element-hq / element-hq/synapse

Local thumbnails with "scale" method use the requested size and not the "scale" size, resulting in cache duplication

Open
#11,853 0 comments 0 reactions 0 assignees View on GitHub
A-Media-Repository S-Minor T-Defect
Dominant language
Python
Stars
4.6k
Forks
600
Avg merge
5d 22h
Merged PRs (30d)
51

Description

This issue has been migrated from [#11853](https://github.com/matrix-org/synapse/issues/11853).

---

### Description

When uploading a media, local thumbnails are generated.
If "dynamic_thumbnails" is set to "true", each request to a thumbnail with a desired size and the the method scale will try to use the cache or generate a new thumbnail if there is none.

The problem is that the cache filenames use the desired size and not the computed "scale" size, resulting in many cache files having the same image size.

That could increase the cache directory's disk size or be used by an attacker to generate all the combination of authorized thumbnails width and height and fill the server's disk.

### Steps to reproduce
- Have a synapse configuration with dynamic_thumbnails to true
- Upload a media
- Request the thumbnail URL with different parameters
- See the local_thumbnails folder's content.

Example with a 1054x361 image upload. Then, after:
- curl https://domain.tld/_matrix/media/r0/thumbnail/domain.tld/mamyvVMhpIgdhQzgMxlsNysZ?width=800&height=600&method=scale
- curl https://domain.tld/_matrix/media/r0/thumbnail/domain.tld/mamyvVMhpIgdhQzgMxlsNysZ?width=800&height=601&method=scale
- curl https://domain.tld/_matrix/media/r0/thumbnail/domain.tld/mamyvVMhpIgdhQzgMxlsNysZ?width=800&height=602&method=scale
- curl https://domain.tld/_matrix/media/r0/thumbnail/domain.tld/mamyvVMhpIgdhQzgMxlsNysZ?width=800&height=603&method=scale
- curl https://domain.tld/_matrix/media/r0/thumbnail/domain.tld/mamyvVMhpIgdhQzgMxlsNysZ?width=801&height=601&method=scale

```
$ synapse/media_store # find ./local_thumbnails/ma/my/vVMhpIgdhQzgMxlsNysZ -type f | xargs file
./local_thumbnails/ma/my/vVMhpIgdhQzgMxlsNysZ/800-600-image-png-scale: PNG image data, 800 x 274, 8-bit/color RGB, non-interlaced
./local_thumbnails/ma/my/vVMhpIgdhQzgMxlsNysZ/800-601-image-png-scale: PNG image data, 800 x 274, 8-bit/color RGB, non-interlaced
./local_thumbnails/ma/my/vVMhpIgdhQzgMxlsNysZ/800-602-image-png-scale: PNG image data, 800 x 274, 8-bit/color RGB, non-interlaced
./local_thumbnails/ma/my/vVMhpIgdhQzgMxlsNysZ/800-603-image-png-scale: PNG image data, 800 x 274, 8-bit/color RGB, non-interlaced
./local_thumbnails/ma/my/vVMhpIgdhQzgMxlsNysZ/801-601-image-png-scale: PNG image data, 801 x 274, 8-bit/color RGB, non-interlaced
```

If the computed "scale" size were used as the cache's filename, fewer files would have been created.

- **Homeserver**:
A private homeserver

- **Version**:
1.50.0

- **Install method**:
Docker

- **Platform**:
Docker on OpenSuse

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.