From 455e6051624316856c8ccaf8bcdb83bd289e2112 Mon Sep 17 00:00:00 2001
From: advplyr <advplyr@protonmail.com>
Date: Fri, 17 Apr 2026 16:30:08 -0500
Subject: [PATCH] Update author & library item image endpoints to clamp
 width/height query params

---
 server/controllers/AuthorController.js      |  6 +++---
 server/controllers/LibraryItemController.js |  6 +++---
 server/utils/index.js                       | 10 ++++++++++
 3 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/server/controllers/AuthorController.js b/server/controllers/AuthorController.js
index 82ed3e50a..80471ec47 100644
--- a/server/controllers/AuthorController.js
+++ b/server/controllers/AuthorController.js
@@ -10,7 +10,7 @@ const CacheManager = require('../managers/CacheManager')
 const CoverManager = require('../managers/CoverManager')
 const AuthorFinder = require('../finders/AuthorFinder')
 
-const { reqSupportsWebp, isValidASIN } = require('../utils/index')
+const { reqSupportsWebp, isValidASIN, clampPositiveInt } = require('../utils/index')
 
 const naturalSort = createNewSortInstance({
   comparer: new Intl.Collator(undefined, { numeric: true, sensitivity: 'base' }).compare
@@ -412,8 +412,8 @@ class AuthorController {
 
     const options = {
       format: format || (reqSupportsWebp(req) ? 'webp' : 'jpeg'),
-      height: height ? parseInt(height) : null,
-      width: width ? parseInt(width) : null
+      height: clampPositiveInt(height ? parseInt(height) : null, 4096),
+      width: clampPositiveInt(width ? parseInt(width) : null, 4096)
     }
     return CacheManager.handleAuthorCache(res, authorId, options)
   }
diff --git a/server/controllers/LibraryItemController.js b/server/controllers/LibraryItemController.js
index 5f7bd9736..1a6b8ac11 100644
--- a/server/controllers/LibraryItemController.js
+++ b/server/controllers/LibraryItemController.js
@@ -7,7 +7,7 @@ const SocketAuthority = require('../SocketAuthority')
 const Database = require('../Database')
 
 const zipHelpers = require('../utils/zipHelpers')
-const { reqSupportsWebp } = require('../utils/index')
+const { reqSupportsWebp, clampPositiveInt } = require('../utils/index')
 const { ScanResult, AudioMimeType } = require('../utils/constants')
 const { getAudioMimeTypeFromExtname, encodeUriPath } = require('../utils/fileUtils')
 const LibraryItemScanner = require('../scanner/LibraryItemScanner')
@@ -398,8 +398,8 @@ class LibraryItemController {
 
     const options = {
       format: format || (reqSupportsWebp(req) ? 'webp' : 'jpeg'),
-      height: height ? parseInt(height) : null,
-      width: width ? parseInt(width) : null
+      height: clampPositiveInt(height ? parseInt(height) : null, 4096),
+      width: clampPositiveInt(width ? parseInt(width) : null, 4096)
     }
     return CacheManager.handleCoverCache(res, libraryItemId, options)
   }
diff --git a/server/utils/index.js b/server/utils/index.js
index c7700a783..49a7c8e67 100644
--- a/server/utils/index.js
+++ b/server/utils/index.js
@@ -54,6 +54,16 @@ module.exports.isNullOrNaN = (num) => {
   return num === null || isNaN(num)
 }
 
+/**
+ * @param {number|null|undefined} value
+ * @param {number} max
+ * @returns {number|null}
+ */
+module.exports.clampPositiveInt = (value, max) => {
+  if (value == null || !Number.isFinite(value) || value <= 0) return null
+  return Math.min(Math.floor(value), max)
+}
+
 const xmlToJSON = (xml) => {
   return new Promise((resolve, reject) => {
     parseString(xml, (err, results) => {