chore(deps): drop the archived image-size dependency

Author: waleedlatif1

apps/sim/lib/content/image-dimensions.test.ts

@@ -0,0 +1,155 @@
+/**
+ * @vitest-environment node
+ */
+import { describe, expect, it } from 'vitest'
+import { readImageDimensions } from '@/lib/content/image-dimensions'
+
+function png(width: number, height: number): Buffer {
+  const buffer = Buffer.alloc(24)
+  Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]).copy(buffer)
+  buffer.writeUInt32BE(13, 8)
+  buffer.write('IHDR', 12, 'latin1')
+  buffer.writeUInt32BE(width, 16)
+  buffer.writeUInt32BE(height, 20)
+  return buffer
+}
+
+/** Builds a JPEG whose SOF0 frame is preceded by `filler` app segments. */
+function jpeg(width: number, height: number, filler: Buffer = Buffer.alloc(0)): Buffer {
+  const sof = Buffer.alloc(11)
+  sof.writeUInt16BE(0xffc0, 0)
+  sof.writeUInt16BE(8, 2)
+  sof.writeUInt8(8, 4)
+  sof.writeUInt16BE(height, 5)
+  sof.writeUInt16BE(width, 7)
+  return Buffer.concat([Buffer.from([0xff, 0xd8]), filler, sof])
+}
+
+function webpVp8x(width: number, height: number): Buffer {
+  const buffer = Buffer.alloc(30)
+  buffer.write('RIFF', 0, 'latin1')
+  buffer.write('WEBP', 8, 'latin1')
+  buffer.write('VP8X', 12, 'latin1')
+  buffer.writeUInt32LE(10, 16)
+  buffer.writeUIntLE(width - 1, 24, 3)
+  buffer.writeUIntLE(height - 1, 27, 3)
+  return buffer
+}
+
+function webpVp8l(width: number, height: number): Buffer {
+  const buffer = Buffer.alloc(25)
+  buffer.write('RIFF', 0, 'latin1')
+  buffer.write('WEBP', 8, 'latin1')
+  buffer.write('VP8L', 12, 'latin1')
+  buffer.writeUInt8(0x2f, 20)
+  buffer.writeUInt32LE(((height - 1) << 14) | (width - 1), 21)
+  return buffer
+}
+
+function webpVp8(width: number, height: number): Buffer {
+  const buffer = Buffer.alloc(30)
+  buffer.write('RIFF', 0, 'latin1')
+  buffer.write('WEBP', 8, 'latin1')
+  buffer.write('VP8 ', 12, 'latin1')
+  Buffer.from([0x9d, 0x01, 0x2a]).copy(buffer, 23)
+  buffer.writeUInt16LE(width, 26)
+  buffer.writeUInt16LE(height, 28)
+  return buffer
+}
+
+describe('readImageDimensions', () => {
+  it('reads PNG dimensions from IHDR', () => {
+    expect(readImageDimensions(png(1200, 630))).toEqual({ width: 1200, height: 630 })
+  })
+
+  it('reads JPEG dimensions from the SOF0 frame', () => {
+    expect(readImageDimensions(jpeg(1920, 1080))).toEqual({ width: 1920, height: 1080 })
+  })
+
+  it('skips JPEG app segments before the frame', () => {
+    const app0 = Buffer.alloc(18)
+    app0.writeUInt16BE(0xffe0, 0)
+    app0.writeUInt16BE(16, 2)
+    app0.write('JFIF\0', 4, 'latin1')
+    expect(readImageDimensions(jpeg(800, 400, app0))).toEqual({ width: 800, height: 400 })
+  })
+
+  it('tolerates JPEG marker padding bytes', () => {
+    expect(readImageDimensions(jpeg(640, 480, Buffer.from([0xff, 0xff, 0xff])))).toEqual({
+      width: 640,
+      height: 480,
+    })
+  })
+
+  it('reads extended WebP canvas dimensions', () => {
+    expect(readImageDimensions(webpVp8x(2400, 1260))).toEqual({ width: 2400, height: 1260 })
+  })
+
+  it('reads lossless WebP dimensions', () => {
+    expect(readImageDimensions(webpVp8l(1024, 768))).toEqual({ width: 1024, height: 768 })
+  })
+
+  it('reads lossy WebP dimensions', () => {
+    expect(readImageDimensions(webpVp8(512, 256))).toEqual({ width: 512, height: 256 })
+  })
+
+  it('returns null for an unrecognized format', () => {
+    expect(readImageDimensions(Buffer.from('not an image at all, really'))).toBeNull()
+  })
+
+  it('returns null for a truncated buffer', () => {
+    expect(readImageDimensions(png(100, 100).subarray(0, 20))).toBeNull()
+  })
+
+  it('returns null when a header declares zero dimensions', () => {
+    expect(readImageDimensions(png(0, 0))).toBeNull()
+    expect(readImageDimensions(jpeg(0, 0))).toBeNull()
+  })
+
+  /**
+   * The `image-size` advisories this parser replaces (GHSA-w3rx-r6r6-pgpr,
+   * GHSA-5p2g-fcmc-qvqq) were zero-valued length fields that left the read
+   * offset unchanged, hanging the event loop. Each case below must terminate.
+   */
+  describe('malformed-length denial-of-service inputs', () => {
+    it('terminates on a JPEG segment declaring zero length', () => {
+      const buffer = Buffer.alloc(64)
+      buffer.writeUInt16BE(0xffd8, 0)
+      buffer.writeUInt16BE(0xffe0, 2)
+      buffer.writeUInt16BE(0, 4)
+      expect(readImageDimensions(buffer)).toBeNull()
+    })
+
+    it('terminates on a JPEG segment declaring a length of one', () => {
+      const buffer = Buffer.alloc(64)
+      buffer.writeUInt16BE(0xffd8, 0)
+      buffer.writeUInt16BE(0xffe0, 2)
+      buffer.writeUInt16BE(1, 4)
+      expect(readImageDimensions(buffer)).toBeNull()
+    })
+
+    it('rejects an ICNS buffer with a zero-valued entry length', () => {
+      const buffer = Buffer.alloc(32)
+      buffer.write('icns', 0, 'latin1')
+      buffer.writeUInt32BE(32, 4)
+      buffer.write('ic07', 8, 'latin1')
+      buffer.writeUInt32BE(0, 12)
+      expect(readImageDimensions(buffer)).toBeNull()
+    })
+
+    it('rejects a HEIF buffer with a zero-valued box size', () => {
+      const buffer = Buffer.alloc(32)
+      buffer.writeUInt32BE(0, 0)
+      buffer.write('ftyp', 4, 'latin1')
+      buffer.write('heic', 8, 'latin1')
+      expect(readImageDimensions(buffer)).toBeNull()
+    })
+
+    it('rejects a JXL buffer with a zero-valued box size', () => {
+      const buffer = Buffer.alloc(32)
+      buffer.writeUInt32BE(0, 0)
+      buffer.write('JXL ', 4, 'latin1')
+      expect(readImageDimensions(buffer)).toBeNull()
+    })
+  })
+})

apps/sim/lib/content/image-dimensions.ts

@@ -0,0 +1,115 @@
+/**
+ * Minimal intrinsic-dimension reader for the image formats the content
+ * pipeline actually ships as OG covers (PNG, JPEG, WebP).
+ *
+ * This replaces the `image-size` package, which is archived upstream and
+ * carries unpatched high-severity DoS advisories (GHSA-w3rx-r6r6-pgpr,
+ * GHSA-5p2g-fcmc-qvqq) in its ICNS/JXL/HEIF parsers — formats this app never
+ * reads. Only the JPEG marker scan loops at all, and it advances on every
+ * iteration regardless of the declared lengths (see `readJpeg`); PNG and WebP
+ * are fixed-offset header reads.
+ */
+
+const PNG_SIGNATURE = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a])
+
+/** JPEG frame markers that carry a size record, excluding DHT/JPG/DAC. */
+const JPEG_SOF_MARKERS = new Set([
+  0xc0, 0xc1, 0xc2, 0xc3, 0xc5, 0xc6, 0xc7, 0xc9, 0xca, 0xcb, 0xcd, 0xce, 0xcf,
+])
+
+export interface ImageDimensions {
+  width: number
+  height: number
+}
+
+function readPng(buffer: Buffer): ImageDimensions | null {
+  if (buffer.length < 24) return null
+  if (buffer.subarray(12, 16).toString('latin1') !== 'IHDR') return null
+  return { width: buffer.readUInt32BE(16), height: buffer.readUInt32BE(20) }
+}
+
+/**
+ * Walks the JPEG marker chain to the first start-of-frame segment.
+ *
+ * The scan always terminates: `offset` grows by at least 1 on every branch, and
+ * a segment declaring a length below the 2-byte minimum lands the next
+ * iteration back on its own length bytes, which cannot be the `0xff` a marker
+ * requires. This is the property the replaced `image-size` parsers lacked.
+ */
+function readJpeg(buffer: Buffer): ImageDimensions | null {
+  let offset = 2
+  while (offset + 3 < buffer.length) {
+    if (buffer[offset] !== 0xff) return null
+    const marker = buffer[offset + 1]
+    if (marker === 0xff) {
+      offset += 1
+      continue
+    }
+    if (marker === 0x01 || (marker >= 0xd0 && marker <= 0xd9)) {
+      offset += 2
+      continue
+    }
+    const segmentLength = buffer.readUInt16BE(offset + 2)
+    if (JPEG_SOF_MARKERS.has(marker)) {
+      if (offset + 9 > buffer.length) return null
+      return { width: buffer.readUInt16BE(offset + 7), height: buffer.readUInt16BE(offset + 5) }
+    }
+    offset += 2 + segmentLength
+  }
+  return null
+}
+
+function readWebp(buffer: Buffer): ImageDimensions | null {
+  const chunkType = buffer.subarray(12, 16).toString('latin1')
+
+  if (chunkType === 'VP8X') {
+    if (buffer.length < 30) return null
+    return {
+      width: buffer.readUIntLE(24, 3) + 1,
+      height: buffer.readUIntLE(27, 3) + 1,
+    }
+  }
+
+  if (chunkType === 'VP8L') {
+    if (buffer.length < 25 || buffer[20] !== 0x2f) return null
+    const bits = buffer.readUInt32LE(21)
+    return {
+      width: (bits & 0x3fff) + 1,
+      height: ((bits >> 14) & 0x3fff) + 1,
+    }
+  }
+
+  if (chunkType === 'VP8 ') {
+    if (buffer.length < 30) return null
+    if (buffer[23] !== 0x9d || buffer[24] !== 0x01 || buffer[25] !== 0x2a) return null
+    return {
+      width: buffer.readUInt16LE(26) & 0x3fff,
+      height: buffer.readUInt16LE(28) & 0x3fff,
+    }
+  }
+
+  return null
+}
+
+/**
+ * Reads intrinsic pixel dimensions from a PNG, JPEG, or WebP buffer. Returns
+ * null for unrecognized formats, truncated buffers, or zero-valued dimensions.
+ */
+export function readImageDimensions(buffer: Buffer): ImageDimensions | null {
+  if (buffer.length < 12) return null
+
+  let dimensions: ImageDimensions | null = null
+  if (buffer.subarray(0, 8).equals(PNG_SIGNATURE)) {
+    dimensions = readPng(buffer)
+  } else if (buffer[0] === 0xff && buffer[1] === 0xd8) {
+    dimensions = readJpeg(buffer)
+  } else if (
+    buffer.subarray(0, 4).toString('latin1') === 'RIFF' &&
+    buffer.subarray(8, 12).toString('latin1') === 'WEBP'
+  ) {
+    dimensions = readWebp(buffer)
+  }
+
+  if (!dimensions || dimensions.width <= 0 || dimensions.height <= 0) return null
+  return dimensions
+}

apps/sim/lib/content/registry-factory.ts

@@ -2,11 +2,12 @@ import fs from 'fs/promises'
 import path from 'path'
 import { cache } from 'react'
 import matter from 'gray-matter'
-import { imageSize } from 'image-size'
 import { compileMDX } from 'next-mdx-remote/rsc'
 import rehypeAutolinkHeadings from 'rehype-autolink-headings'
 import rehypeSlug from 'rehype-slug'
 import remarkGfm from 'remark-gfm'
+import type { ImageDimensions } from '@/lib/content/image-dimensions'
+import { readImageDimensions } from '@/lib/content/image-dimensions'
 import { mdxComponents } from '@/lib/content/mdx'
 import type { Author, ContentMeta, ContentPost, TagWithCount } from '@/lib/content/schema'
 import { AuthorSchema, ContentFrontmatterSchema } from '@/lib/content/schema'
@@ -96,14 +97,11 @@ export function createContentRegistry(config: ContentRegistryConfig): ContentReg
    * null for remote URLs or unreadable files, in which case the builders fall
    * back to the 1200x630 OG default.
    */
-  async function readOgImageDimensions(
-    ogImage: string
-  ): Promise<{ width: number; height: number } | null> {
+  async function readOgImageDimensions(ogImage: string): Promise<ImageDimensions | null> {
     if (ogImage.startsWith('http')) return null
     try {
       const buffer = await fs.readFile(path.join(process.cwd(), 'public', ogImage))
-      const { width, height } = imageSize(buffer)
-      return width && height ? { width, height } : null
+      return readImageDimensions(buffer)
     } catch {
       return null
     }

apps/sim/package.json

@@ -174,7 +174,6 @@
     "http-proxy-agent": "7.0.2",
     "https-proxy-agent": "7.0.6",
     "idb-keyval": "6.2.2",
-    "image-size": "2.0.2",
     "imapflow": "1.2.4",
     "input-otp": "^1.4.2",
     "ioredis": "^5.6.0",