Skip to content

Request an image and send it over Rocket #2849

Closed Answered by SergioBenitez
Swarkin asked this question in Questions
Discussion options

You must be logged in to vote
	let url = MAP_URL.to_owned() + bbox;
	let resp = state.client.get(url).send().await.unwrap();

This is a security vulnerability. You're letting the client make a request to wherever they want.

-> Response

You cannot return a Response because allowing this to happen results in code that isn't reusable and riddled with details that don't matter. Rocket wants to protect you from that. Your entire route can be written correctly, idiomatically, and securely:

#[get("/<bbox>")]
async fn map(state: State<MyState>, bbox: PathBuf) -> Option<(ContentType, Vec<u8>)> {
	let resp = state.client.get(MAP_URL + bbox).send().ok()?;
	let bytes = resp.bytes().await.ok()?; // FIXME: What if the response is to…

Replies: 1 comment

Comment options

You must be logged in to vote
0 replies
Answer selected by Swarkin
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
2 participants