Skip to content

block HTTP redirects for image loading - #2327

Merged
TheNoumanDev merged 2 commits into
android_TV_implementationfrom
fix/block-image-redirects
Jul 27, 2026
Merged

block HTTP redirects for image loading#2327
TheNoumanDev merged 2 commits into
android_TV_implementationfrom
fix/block-image-redirects

Conversation

@usmanvrtx

Copy link
Copy Markdown
Contributor

Description

This PR blocks HTTP redirects for image loading in the Ensemble Image widget to prevent potential redirect-based attacks (SSRF). A custom RedirectBlockingHttpClient is used both for individual image requests and within the image cache manager.

Related Issue

N/A

Type of Change

  • Bug fix (non-breaking change that fixes an issue)
  • New feature (non-breaking change that adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Documentation update
  • Refactoring (no functional changes)

What Has Changed

  • Added RedirectBlockingHttpClient class that prevents HTTP redirects by setting followRedirects = false and throwing ClientException on 3xx responses
  • Updated EnsembleImageCacheManager cache key to ensembleImageCacheKeyNoRedirect to invalidate old cache entries
  • Applied errorBuilder callback to cached network images for graceful fallback
  • Added httpClient: RedirectBlockingHttpClient() to cached network image requests
  • Configured HttpFileService with RedirectBlockingHttpClient in cache manager
  • Added unit test for redirect-blocking client behavior

How to Test

  1. Run the existing image widget tests: flutter test modules/ensemble/test/widget/image_widget_test.dart
  2. Verify the new redirect-blocking test passes
  3. Test loading images from URLs that would redirect and confirm they are blocked with a ClientException

Screenshots / Videos

N/A

Checklist

  • I have run flutter analyze and addressed any new warnings
  • I have run flutter test and all tests pass
  • I have tested my changes on the relevant platform(s)
  • I have updated documentation if needed
  • My changes do not introduce new warnings or errors

@usmanvrtx usmanvrtx changed the title fix: block HTTP redirects for image loading to prevent redirect attacks block HTTP redirects for image loading Jul 27, 2026
@usmanvrtx
usmanvrtx requested a review from TheNoumanDev July 27, 2026 14:03
@usmanvrtx usmanvrtx self-assigned this Jul 27, 2026
@usmanvrtx
usmanvrtx removed the request for review from TheNoumanDev July 27, 2026 14:04
@usmanvrtx
usmanvrtx changed the base branch from main to android_TV_implementation July 27, 2026 14:05
@usmanvrtx
usmanvrtx requested a review from TheNoumanDev July 27, 2026 14:07
@usmanvrtx usmanvrtx removed their assignment Jul 27, 2026
@TheNoumanDev
TheNoumanDev merged commit 6f64d13 into android_TV_implementation Jul 27, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants