Skip to content

Fix retrieval of remote source logos in GeoNetwork harvesters.#9187

Open
josegar74 wants to merge 4 commits intogeonetwork:mainfrom
GeoCat:fix-gnharvestersourceslogos
Open

Fix retrieval of remote source logos in GeoNetwork harvesters.#9187
josegar74 wants to merge 4 commits intogeonetwork:mainfrom
GeoCat:fix-gnharvestersourceslogos

Conversation

@josegar74
Copy link
Member

Logo retrieval was assuming that the logos extension was gif only, which is not the case, png and jpg formats are allowed also.

Checklist

  • I have read the contribution guidelines
  • Pull request provided for main branch, backports managed with label
  • Good housekeeping of code, cleaning up comments, tests, and documentation
  • Clean commit history broken into understandable chucks, avoiding big commits with hundreds of files, cautious of reformatting and whitespace changes
  • Clean commit messages, longer verbose messages are encouraged
  • API Changes are identified in commit messages
  • Testing provided for features or enhancements using automatic tests
  • User documentation provided for new features or enhancements in manual
  • Build documentation provided for development instructions in README.md files
  • Library management using pom.xml dependency management. Update build documentation with intended library use and library tutorials or documentation
Logo retrieval was assuming that the logos extension was gif only
@josegar74 josegar74 added this to the 4.4.10 milestone Feb 26, 2026
@josegar74 josegar74 added the bug label Feb 26, 2026
Copy link
Member

@fxprunayre fxprunayre left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks fine. Can be tested with https://sextant.ifremer.fr/geonetwork/images/logos/b08fe709-1ced-4a07-8edf-06aa6ccdf2e3.gif vs https://sextant.ifremer.fr/geonetwork/images/logos/b08fe709-1ced-4a07-8edf-06aa6ccdf2e3.png

At some point, maybe we should consider adding a dedicated endpoint for source logo retrieval without relying on image extension.

Copy link
Contributor

@juanluisrp juanluisrp left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There ia a security issue in this code.

@josegar74
Copy link
Member Author

@juanluisrp I have added in the harvester code to check that the logo doesn't contain bad path characters. See 4a6ef4b

I haven't update XmlRequest. For that we can do another pull request, probably sending also a base path so the code checks that the file path is inside the base path.

@josegar74
Copy link
Member Author

@juanluisrp please check the latest commit: 8e53529

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

3 participants