improvement(content): cover GIF and warn when OG dimensions are unreadable

Author: waleedlatif1

apps/sim/lib/content/image-dimensions.test.ts

@@ -57,6 +57,14 @@ function webpVp8(width: number, height: number): Buffer {
   return buffer
 }
 
+function gif(width: number, height: number, version: 'GIF87a' | 'GIF89a' = 'GIF89a'): Buffer {
+  const buffer = Buffer.alloc(14)
+  buffer.write(version, 0, 'latin1')
+  buffer.writeUInt16LE(width, 6)
+  buffer.writeUInt16LE(height, 8)
+  return buffer
+}
+
 describe('readImageDimensions', () => {
   it('reads PNG dimensions from IHDR', () => {
     expect(readImageDimensions(png(1200, 630))).toEqual({ width: 1200, height: 630 })
@@ -93,10 +101,30 @@ describe('readImageDimensions', () => {
     expect(readImageDimensions(webpVp8(512, 256))).toEqual({ width: 512, height: 256 })
   })
 
+  it('reads GIF dimensions from the logical screen descriptor', () => {
+    expect(readImageDimensions(gif(800, 424))).toEqual({ width: 800, height: 424 })
+    expect(readImageDimensions(gif(640, 722, 'GIF87a'))).toEqual({ width: 640, height: 722 })
+  })
+
   it('returns null for an unrecognized format', () => {
     expect(readImageDimensions(Buffer.from('not an image at all, really'))).toBeNull()
   })
 
+  /**
+   * SVG and ICO are intentionally out of scope — neither is a valid `og:image`
+   * for the social crawlers, and callers fall back to the OG default.
+   */
+  it('returns null for SVG and ICO', () => {
+    expect(readImageDimensions(Buffer.from('<svg width="222" height="222"></svg>'))).toBeNull()
+    const ico = Buffer.alloc(16)
+    ico.writeUInt16LE(0, 0)
+    ico.writeUInt16LE(1, 2)
+    ico.writeUInt16LE(1, 4)
+    ico.writeUInt8(32, 6)
+    ico.writeUInt8(32, 7)
+    expect(readImageDimensions(ico)).toBeNull()
+  })
+
   it('returns null for a truncated buffer', () => {
     expect(readImageDimensions(png(100, 100).subarray(0, 20))).toBeNull()
   })

apps/sim/lib/content/image-dimensions.ts

@@ -1,17 +1,25 @@
 /**
- * Minimal intrinsic-dimension reader for the image formats the content
- * pipeline actually ships as OG covers (PNG, JPEG, WebP).
+ * Minimal intrinsic-dimension reader for the raster formats that are valid as
+ * social preview images: PNG, JPEG, WebP, and GIF.
  *
  * This replaces the `image-size` package, which is archived upstream and
  * carries unpatched high-severity DoS advisories (GHSA-w3rx-r6r6-pgpr,
  * GHSA-5p2g-fcmc-qvqq) in its ICNS/JXL/HEIF parsers — formats this app never
  * reads. Only the JPEG marker scan loops at all, and it advances on every
- * iteration regardless of the declared lengths (see `readJpeg`); PNG and WebP
- * are fixed-offset header reads.
+ * iteration regardless of the declared lengths (see `readJpeg`); the rest are
+ * fixed-offset header reads.
+ *
+ * SVG and ICO are deliberately unsupported: neither is accepted as an
+ * `og:image` by the major social crawlers, and reading SVG dimensions means
+ * regex-matching untrusted-shaped XML, which is the failure class that
+ * motivated removing the dependency in the first place. Callers are expected
+ * to treat a null return as "fall back to the declared OG default".
  */
 
 const PNG_SIGNATURE = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a])
 
+const GIF_SIGNATURES = new Set(['GIF87a', 'GIF89a'])
+
 /** JPEG frame markers that carry a size record, excluding DHT/JPG/DAC. */
 const JPEG_SOF_MARKERS = new Set([
   0xc0, 0xc1, 0xc2, 0xc3, 0xc5, 0xc6, 0xc7, 0xc9, 0xca, 0xcb, 0xcd, 0xce, 0xcf,
@@ -59,6 +67,11 @@ function readJpeg(buffer: Buffer): ImageDimensions | null {
   return null
 }
 
+function readGif(buffer: Buffer): ImageDimensions | null {
+  if (buffer.length < 10) return null
+  return { width: buffer.readUInt16LE(6), height: buffer.readUInt16LE(8) }
+}
+
 function readWebp(buffer: Buffer): ImageDimensions | null {
   const chunkType = buffer.subarray(12, 16).toString('latin1')
 
@@ -92,8 +105,9 @@ function readWebp(buffer: Buffer): ImageDimensions | null {
 }
 
 /**
- * Reads intrinsic pixel dimensions from a PNG, JPEG, or WebP buffer. Returns
- * null for unrecognized formats, truncated buffers, or zero-valued dimensions.
+ * Reads intrinsic pixel dimensions from a PNG, JPEG, WebP, or GIF buffer.
+ * Returns null for unrecognized formats, truncated buffers, or zero-valued
+ * dimensions.
  */
 export function readImageDimensions(buffer: Buffer): ImageDimensions | null {
   if (buffer.length < 12) return null
@@ -108,6 +122,8 @@ export function readImageDimensions(buffer: Buffer): ImageDimensions | null {
     buffer.subarray(8, 12).toString('latin1') === 'WEBP'
   ) {
     dimensions = readWebp(buffer)
+  } else if (GIF_SIGNATURES.has(buffer.subarray(0, 6).toString('latin1'))) {
+    dimensions = readGif(buffer)
   }
 
   if (!dimensions || dimensions.width <= 0 || dimensions.height <= 0) return null

apps/sim/lib/content/registry-factory.ts

@@ -1,6 +1,7 @@
 import fs from 'fs/promises'
 import path from 'path'
 import { cache } from 'react'
+import { createLogger } from '@sim/logger'
 import matter from 'gray-matter'
 import { compileMDX } from 'next-mdx-remote/rsc'
 import rehypeAutolinkHeadings from 'rehype-autolink-headings'
@@ -13,6 +14,8 @@ import type { Author, ContentMeta, ContentPost, TagWithCount } from '@/lib/conte
 import { AuthorSchema, ContentFrontmatterSchema } from '@/lib/content/schema'
 import { byDateDesc, ensureContentDirs, toIsoDate } from '@/lib/content/utils'
 
+const logger = createLogger('ContentRegistry')
+
 /** Loads a post's custom MDX component overrides, keyed by slug. */
 export type ContentComponentLoaders = Record<
   string,
@@ -101,7 +104,13 @@ export function createContentRegistry(config: ContentRegistryConfig): ContentReg
     if (ogImage.startsWith('http')) return null
     try {
       const buffer = await fs.readFile(path.join(process.cwd(), 'public', ogImage))
-      return readImageDimensions(buffer)
+      const dimensions = readImageDimensions(buffer)
+      if (!dimensions) {
+        logger.warn('OG image dimensions could not be read; falling back to the OG default', {
+          ogImage,
+        })
+      }
+      return dimensions
     } catch {
       return null
     }