From 8c5c36eb86963d2ba7c2ae197f366b9c5f6f8772 Mon Sep 17 00:00:00 2001 From: Matchu Date: Fri, 12 Mar 2021 04:30:00 -0800 Subject: [PATCH] Fix outfit thumbnails for new items New items have ?v= in the query string, which denied requesting them from the outfit thumbnail API route. Now, we allow any query string. Also, I started allowing PNGs. I don't think any should actually come through here in practice? But it seems safe and forward-looking. --- api/outfitImage.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/api/outfitImage.js b/api/outfitImage.js index 3f283d0..158c417 100644 --- a/api/outfitImage.js +++ b/api/outfitImage.js @@ -11,7 +11,7 @@ const { renderOutfitImage } = require("../src/server/outfit-images"); const VALID_LAYER_URLS = [ /^https:\/\/impress-asset-images\.s3\.amazonaws\.com\/(biology|object)\/[0-9]{3}\/[0-9]{3}\/[0-9]{3}\/[0-9]+\/(150|300)x(150|300)\.png(\?[a-zA-Z0-9_-]+)?$/, - /^http:\/\/images\.neopets\.com\/cp\/(bio|object|items)\/data\/[0-9]{3}\/[0-9]{3}\/[0-9]{3}\/[a-zA-Z0-9_-]+\/[a-zA-Z0-9_-]+\.svg$/, + /^http:\/\/images\.neopets\.com\/cp\/(bio|object|items)\/data\/[0-9]{3}\/[0-9]{3}\/[0-9]{3}\/[a-zA-Z0-9_-]+\/[a-zA-Z0-9_-]+\.(svg|png)(\?.*)?$/, ]; async function handle(req, res) {