Fund: LibWeb: Implement MIME type sniffing for images

The type check for SVG images is insufficient and self-admittedly ad-hoc:

serenity/Userland/Libraries/LibWeb/HTML/SharedImageRequest.cpp

Lines 131 to 134 in 1a29ff6

    
           // AD-HOC: At this point, things gets very ad-hoc. 
        
           // FIXME: Bring this closer to spec. 
        
           bool const is_svg_image = mime_type == "image/svg+xml"sv || url_string.basename().ends_with(".svg"sv);

For example, the following image ends with .svg but was presumably re-encoded to WebP by Cloudflare Image Optimization: https://res.cloudinary.com/tripactions/image/upload/f_auto/q_auto/v1691083932/site/customer-logo/logo_ZM_wordmark_bloom-RGB.svg

This causes a crash here as we're scanning a WebP image as though it's HTML with valid UTF-8 attributes:

serenity/Userland/Libraries/LibWeb/HTML/Parser/HTMLEncodingDetection.cpp

Lines 152 to 153 in 1a29ff6

    
           if (input[position] == '\t' || input[position] == '\n' || input[position] == '\f' || input[position] == '\r' || input[position] == ' ' || input[position] == '>') 
        
               return DOM::Attr::create(document, MUST(attribute_name.to_string()), MUST(attribute_value.to_string()));

VERIFICATION FAILED: !_temporary_result.is_error() at /home/lukew/Desktop/serenity-project/serenity/Userland/Libraries/LibWeb/HTML/Parser/HTMLEncodingDetection.cpp:153
/home/lukew/Desktop/serenity-project/serenity/Build/lagom/lib/liblagom-core.so.0(ak_verification_failed+0x96) [0x7f373d4eb276]
/home/lukew/Desktop/serenity-project/serenity/Build/lagom/lib/liblagom-web.so.0(+0x67ac0e) [0x7f373ca7ac0e]
/home/lukew/Desktop/serenity-project/serenity/Build/lagom/lib/liblagom-web.so.0 Web::HTML::run_prescan_byte_stream_algorithm(Web::DOM::Document&, AK::Detail::ByteBuffer<32ul> const&) 0x82e) [0x7f373ca7b43e]
/home/lukew/Desktop/serenity-project/serenity/Build/lagom/lib/liblagom-web.so.0 Web::HTML::run_encoding_sniffing_algorithm(Web::DOM::Document&, AK::Detail::ByteBuffer<32ul> const&) 0x8c) [0x7f373ca7b6ec]
/home/lukew/Desktop/serenity-project/serenity/Build/lagom/lib/liblagom-web.so.0 Web::HTML::HTMLParser::create_with_uncertain_encoding(Web::DOM::Document&, AK::Detail::ByteBuffer<32ul> const&) 0x91) [0x7f373ca98671]
/home/lukew/Desktop/serenity-project/serenity/Build/lagom/lib/liblagom-web.so.0 Web::SVG::SVGDecodedImageData::create(Web::Page&, AK::URL const&, AK::Detail::ByteBuffer<32ul>) 0x553) [0x7f373cbef833]
/home/lukew/Desktop/serenity-project/serenity/Build/lagom/lib/liblagom-web.so.0 Web::HTML::SharedImageRequest::handle_successful_fetch(AK::URL const&, AK::StringView, AK::Detail::ByteBuffer<32ul>) 0x1cf) [0x7f373cac708f]

It seems we need to implement this part of the spec:

The user agent should apply the image sniffing rules to determine the type of the image, with the image's associated Content-Type headers giving the official type. If these rules are not applied, then the type of the image must be the type given by the image's associated Content-Type headers.

https://html.spec.whatwg.org/#images-processing-model:content-type-sniffing:-image
https://mimesniff.spec.whatwg.org/#rules-for-sniffing-images-specifically

SerenityOS/serenity

LibWeb: Implement MIME type sniffing for images

How does funding with Polar work?

Backer

Contributor

Maintainer

	// AD-HOC: At this point, things gets very ad-hoc.
	// FIXME: Bring this closer to spec.

	bool const is_svg_image = mime_type == "image/svg+xml"sv \|\| url_string.basename().ends_with(".svg"sv);

	if (input[position] == '\t' \|\| input[position] == '\n' \|\| input[position] == '\f' \|\| input[position] == '\r' \|\| input[position] == ' ' \|\| input[position] == '>')
	return DOM::Attr::create(document, MUST(attribute_name.to_string()), MUST(attribute_value.to_string()));

SerenityOS/serenity

LibWeb: Implement MIME type sniffing for images

How does funding with Polar work?

Backer

Why does "Fund on completion" require GitHub login?

When is the invoice due for "Fund on completion"?

What happens if the issue is never completed?

Do I get any extra benefits by funding?

Do I get progress updates?

Contributor

Do I get a reward?

Is rewards guaranteed?

Maintainer

How can I get funding like this for my open source initiatives?