Skip to content

Fix retrieval of remote source logos in GeoNetwork harvesters.#9187

Open
josegar74 wants to merge 4 commits intogeonetwork:mainfrom
GeoCat:fix-gnharvestersourceslogos
Open

Fix retrieval of remote source logos in GeoNetwork harvesters.#9187
josegar74 wants to merge 4 commits intogeonetwork:mainfrom
GeoCat:fix-gnharvestersourceslogos

Conversation

@josegar74
Copy link
Copy Markdown
Member

Logo retrieval was assuming that the logos extension was gif only, which is not the case, png and jpg formats are allowed also.

Checklist

  • I have read the contribution guidelines
  • Pull request provided for main branch, backports managed with label
  • Good housekeeping of code, cleaning up comments, tests, and documentation
  • Clean commit history broken into understandable chucks, avoiding big commits with hundreds of files, cautious of reformatting and whitespace changes
  • Clean commit messages, longer verbose messages are encouraged
  • API Changes are identified in commit messages
  • Testing provided for features or enhancements using automatic tests
  • User documentation provided for new features or enhancements in manual
  • Build documentation provided for development instructions in README.md files
  • Library management using pom.xml dependency management. Update build documentation with intended library use and library tutorials or documentation

Logo retrieval was assuming that the logos extension was gif only
@josegar74 josegar74 added this to the 4.4.10 milestone Feb 26, 2026
@josegar74 josegar74 added the bug label Feb 26, 2026
Copy link
Copy Markdown
Member

@fxprunayre fxprunayre left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks fine. Can be tested with https://sextant.ifremer.fr/geonetwork/images/logos/b08fe709-1ced-4a07-8edf-06aa6ccdf2e3.gif vs https://sextant.ifremer.fr/geonetwork/images/logos/b08fe709-1ced-4a07-8edf-06aa6ccdf2e3.png

At some point, maybe we should consider adding a dedicated endpoint for source logo retrieval without relying on image extension.

Copy link
Copy Markdown
Contributor

@juanluisrp juanluisrp left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There ia a security issue in this code.

@josegar74
Copy link
Copy Markdown
Member Author

@juanluisrp I have added in the harvester code to check that the logo doesn't contain bad path characters. See 4a6ef4b

I haven't update XmlRequest. For that we can do another pull request, probably sending also a base path so the code checks that the file path is inside the base path.

@josegar74
Copy link
Copy Markdown
Member Author

@juanluisrp please check the latest commit: 8e53529

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants