Merge pull request #346 from bnema/feat/webp-favicons

feat(favicon): decode WebP favicons safely

commit: 513887caaed76906369620157f1c762fb4b16793
author: bnema · 3mo ago · 2026-07-14 17:26 UTC
committer: GitHub · 3mo ago · 2026-07-14 17:26 UTC
merge of: 45b5ee0 + d921a00 · diff against the first parent
signature: GPG UnverifiedB5690EEEBB952194 The key is unknown

19 files · +1902 -11

M README.md +3 -2


@@ -134,7 +134,7 @@ Dumber uses Chromium Embedded Framework by default. WebKitGTK is available as a
134	134		On Arch Linux, install the CEF runtime with:
135	135
136	136		```bash
137		-	sudo pacman -S cef
	137	+	sudo pacman -S cef libwebp
138	138		```
139	139
140	140		For hardware video decoding, `cef-vaapi` is also available from the AUR as an optional CEF build.

@@ -179,7 +179,7 @@ CEF OSR frame rate adapts to the active Wayland monitor refresh rate when both `
179	179		Arch Linux:
180	180
181	181		```bash
182		-	sudo pacman -S cef webkitgtk-6.0 gtk4 gst-plugins-base gst-plugins-good gst-plugins-bad gst-plugin-va
	182	+	sudo pacman -S cef webkitgtk-6.0 gtk4 libwebp gst-plugins-base gst-plugins-good gst-plugins-bad gst-plugin-va
183	183		```
184	184
185	185		Debian/Ubuntu:

@@ -213,6 +213,7 @@ Set `ENV=dev` to use `.dev/dumber/` for config and data instead of XDG paths.
213	213		- CEF runtime (default backend)
214	214		- WebKitGTK 6.0 development/runtime packages (fallback backend and runtime checks)
215	215		- Brotli for compressed systemviews assets
	216	+	- libwebp runtime for WebP favicon decoding (for example `libwebp` on Arch)
216	217
217	218		Systemviews assets are generated with `go tool templ` and Go's `js/wasm` toolchain; no root Node toolchain is required.
218	219


@@ -134,7 +134,7 @@ Dumber uses Chromium Embedded Framework by default. WebKitGTK is available as a
134		On Arch Linux, install the CEF runtime with:	134		On Arch Linux, install the CEF runtime with:
135			135
136		```bash	136		```bash
137	-	sudo pacman -S cef	137	+	sudo pacman -S cef libwebp
138		```	138		```
139			139
140		For hardware video decoding, `cef-vaapi` is also available from the AUR as an optional CEF build.	140		For hardware video decoding, `cef-vaapi` is also available from the AUR as an optional CEF build.

@@ -179,7 +179,7 @@ CEF OSR frame rate adapts to the active Wayland monitor refresh rate when both `
179		Arch Linux:	179		Arch Linux:
180			180
181		```bash	181		```bash
182	-	sudo pacman -S cef webkitgtk-6.0 gtk4 gst-plugins-base gst-plugins-good gst-plugins-bad gst-plugin-va	182	+	sudo pacman -S cef webkitgtk-6.0 gtk4 libwebp gst-plugins-base gst-plugins-good gst-plugins-bad gst-plugin-va
183		```	183		```
184			184
185		Debian/Ubuntu:	185		Debian/Ubuntu:

@@ -213,6 +213,7 @@ Set `ENV=dev` to use `.dev/dumber/` for config and data instead of XDG paths.
213		- CEF runtime (default backend)	213		- CEF runtime (default backend)
214		- WebKitGTK 6.0 development/runtime packages (fallback backend and runtime checks)	214		- WebKitGTK 6.0 development/runtime packages (fallback backend and runtime checks)
215		- Brotli for compressed systemviews assets	215		- Brotli for compressed systemviews assets
			216	+	- libwebp runtime for WebP favicon decoding (for example `libwebp` on Arch)
216			217
217		Systemviews assets are generated with `go tool templ` and Go's `js/wasm` toolchain; no root Node toolchain is required.	218		Systemviews assets are generated with `go tool templ` and Go's `js/wasm` toolchain; no root Node toolchain is required.
218			219

M aur/dumber-browser-bin/.SRCINFO +1 -0


@@ -8,6 +8,7 @@ pkgbase = dumber-browser-bin
8	8		depends = gtk4
9	9		depends = cef
10	10		depends = webkitgtk-6.0
	11	+	depends = libwebp
11	12		optdepends = gst-plugins-base: Base media codecs
12	13		optdepends = gst-plugins-good: Additional media codecs
13	14		optdepends = gst-plugins-bad: Extended media codecs


@@ -8,6 +8,7 @@ pkgbase = dumber-browser-bin
8	depends = gtk4	8		depends = gtk4
9	depends = cef	9		depends = cef
10	depends = webkitgtk-6.0	10		depends = webkitgtk-6.0
		11	+	depends = libwebp
11	optdepends = gst-plugins-base: Base media codecs	12		optdepends = gst-plugins-base: Base media codecs
12	optdepends = gst-plugins-good: Additional media codecs	13		optdepends = gst-plugins-good: Additional media codecs
13	optdepends = gst-plugins-bad: Extended media codecs	14		optdepends = gst-plugins-bad: Extended media codecs

M aur/dumber-browser-bin/PKGBUILD +1 -1


@@ -6,7 +6,7 @@ pkgdesc="A minimal keyboard-driven browser for tiling WMs"
6	6		arch=('x86_64')
7	7		url="https://github.com/bnema/dumber"
8	8		license=('MIT')
9		-	depends=('gtk4' 'cef' 'webkitgtk-6.0')
	9	+	depends=('gtk4' 'cef' 'webkitgtk-6.0' 'libwebp')
10	10		optdepends=(
11	11		'gst-plugins-base: Base media codecs'
12	12		'gst-plugins-good: Additional media codecs'


@@ -6,7 +6,7 @@ pkgdesc="A minimal keyboard-driven browser for tiling WMs"
6		arch=('x86_64')	6		arch=('x86_64')
7		url="https://github.com/bnema/dumber"	7		url="https://github.com/bnema/dumber"
8		license=('MIT')	8		license=('MIT')
9	-	depends=('gtk4' 'cef' 'webkitgtk-6.0')	9	+	depends=('gtk4' 'cef' 'webkitgtk-6.0' 'libwebp')
10		optdepends=(	10		optdepends=(
11		'gst-plugins-base: Base media codecs'	11		'gst-plugins-base: Base media codecs'
12		'gst-plugins-good: Additional media codecs'	12		'gst-plugins-good: Additional media codecs'

M aur/dumber-browser-git/.SRCINFO +1 -0


@@ -11,6 +11,7 @@ pkgbase = dumber-browser-git
11	11		depends = gtk4
12	12		depends = cef
13	13		depends = webkitgtk-6.0
	14	+	depends = libwebp
14	15		optdepends = gst-plugins-base: Base media codecs
15	16		optdepends = gst-plugins-good: Additional media codecs
16	17		optdepends = gst-plugins-bad: Extended media codecs


@@ -11,6 +11,7 @@ pkgbase = dumber-browser-git
11	depends = gtk4	11		depends = gtk4
12	depends = cef	12		depends = cef
13	depends = webkitgtk-6.0	13		depends = webkitgtk-6.0
		14	+	depends = libwebp
14	optdepends = gst-plugins-base: Base media codecs	15		optdepends = gst-plugins-base: Base media codecs
15	optdepends = gst-plugins-good: Additional media codecs	16		optdepends = gst-plugins-good: Additional media codecs
16	optdepends = gst-plugins-bad: Extended media codecs	17		optdepends = gst-plugins-bad: Extended media codecs

M aur/dumber-browser-git/PKGBUILD +1 -1


@@ -7,7 +7,7 @@ arch=('x86_64')
7	7		url="https://github.com/bnema/dumber"
8	8		license=('MIT')
9	9		makedepends=('go>=1.26' 'git' 'brotli')
10		-	depends=('gtk4' 'cef' 'webkitgtk-6.0')
	10	+	depends=('gtk4' 'cef' 'webkitgtk-6.0' 'libwebp')
11	11		optdepends=(
12	12		'gst-plugins-base: Base media codecs'
13	13		'gst-plugins-good: Additional media codecs'


@@ -7,7 +7,7 @@ arch=('x86_64')
7		url="https://github.com/bnema/dumber"	7		url="https://github.com/bnema/dumber"
8		license=('MIT')	8		license=('MIT')
9		makedepends=('go>=1.26' 'git' 'brotli')	9		makedepends=('go>=1.26' 'git' 'brotli')
10	-	depends=('gtk4' 'cef' 'webkitgtk-6.0')	10	+	depends=('gtk4' 'cef' 'webkitgtk-6.0' 'libwebp')
11		optdepends=(	11		optdepends=(
12		'gst-plugins-base: Base media codecs'	12		'gst-plugins-base: Base media codecs'
13		'gst-plugins-good: Additional media codecs'	13		'gst-plugins-good: Additional media codecs'

M flatpak/dev.bnema.Dumber.yml +1 -0

@@ -1,6 +1,7 @@
1	1		id: dev.bnema.Dumber
2	2		runtime: org.gnome.Platform
3	3		runtime-version: '49'
	4	+	# org.gnome.Platform provides libwebp at runtime for purego WebP favicon decoding.
4	5		sdk: org.gnome.Sdk
5	6		command: dumber
6	7

@@ -1,6 +1,7 @@
1	id: dev.bnema.Dumber	1		id: dev.bnema.Dumber
2	runtime: org.gnome.Platform	2		runtime: org.gnome.Platform
3	runtime-version: '49'	3		runtime-version: '49'
		4	+	# org.gnome.Platform provides libwebp at runtime for purego WebP favicon decoding.
4	sdk: org.gnome.Sdk	5		sdk: org.gnome.Sdk
5	command: dumber	6		command: dumber
6		7

M go.mod +1 -0


@@ -10,6 +10,7 @@ require (
10	10		github.com/bnema/purego-cef2gtk v0.8.4-0.20260714160309-bbd397409ebe
11	11		github.com/bnema/purego-pipewire v0.1.5-0.20260714124450-6504b9cdf02a
12	12		github.com/bnema/purego-sqlite v0.1.4-0.20260714131321-3614fe683b9c
	13	+	github.com/bnema/purego-webp v0.2.1-0.20260714152238-7bc9c402fdf6
13	14		github.com/bnema/puregotk v0.7.1-0.20260714170452-0b6b9b901234
14	15		github.com/charmbracelet/bubbles v1.0.0
15	16		github.com/charmbracelet/bubbletea v1.3.10


@@ -10,6 +10,7 @@ require (
10	github.com/bnema/purego-cef2gtk v0.8.4-0.20260714160309-bbd397409ebe	10		github.com/bnema/purego-cef2gtk v0.8.4-0.20260714160309-bbd397409ebe
11	github.com/bnema/purego-pipewire v0.1.5-0.20260714124450-6504b9cdf02a	11		github.com/bnema/purego-pipewire v0.1.5-0.20260714124450-6504b9cdf02a
12	github.com/bnema/purego-sqlite v0.1.4-0.20260714131321-3614fe683b9c	12		github.com/bnema/purego-sqlite v0.1.4-0.20260714131321-3614fe683b9c
		13	+	github.com/bnema/purego-webp v0.2.1-0.20260714152238-7bc9c402fdf6
13	github.com/bnema/puregotk v0.7.1-0.20260714170452-0b6b9b901234	14		github.com/bnema/puregotk v0.7.1-0.20260714170452-0b6b9b901234
14	github.com/charmbracelet/bubbles v1.0.0	15		github.com/charmbracelet/bubbles v1.0.0
15	github.com/charmbracelet/bubbletea v1.3.10	16		github.com/charmbracelet/bubbletea v1.3.10

M go.sum +2 -0 generated file: collapsed

load diff

M internal/application/usecase/favicon_test.go +19 -0


@@ -404,6 +404,25 @@ func TestFaviconObserveConversionErrorDoesNotMutateExistingAssets(t *testing.T)
404	404		}
405	405		}
406	406
	407	+	func TestFaviconObserveUnavailableWebPPreservesCachedAssets(t *testing.T) {
	408	+	fx := newFaviconFixture(t)
	409	+	fx.seedOriginal([]byte("old"))
	410	+	fx.blobs.png["example.com"] = []byte("old-png")
	411	+	fx.blobs.sized["example.com"] = map[int][]byte{32: []byte("old-32")}
	412	+	fx.converter.errByContentType = map[string]error{"image/webp": ErrFaviconMiss}
	413	+
	414	+	_, err := fx.uc.Observe(context.Background(), "https://example.com", "https://example.com/favicon.webp", []byte("webp"), favicon.SourceEngine, "image/webp")
	415	+	if !errors.Is(err, ErrFaviconMiss) {
	416	+	t.Fatalf("Observe err=%v, want favicon miss", err)
	417	+	}
	418	+	if string(fx.blobs.original["example.com"]) != "old" \|\| string(fx.blobs.png["example.com"]) != "old-png" \|\| string(fx.blobs.sized["example.com"][32]) != "old-32" {
	419	+	t.Fatalf("cached assets changed after unavailable WebP decoder")
	420	+	}
	421	+	if fx.blobs.writeOriginals != 0 \|\| fx.blobs.removeDerived != 0 \|\| fx.invalidators.calls != 0 {
	422	+	t.Fatalf("unavailable decoder mutated cache: writes=%d removes=%d invalidations=%d", fx.blobs.writeOriginals, fx.blobs.removeDerived, fx.invalidators.calls)
	423	+	}
	424	+	}
	425	+
407	426		func TestFaviconEnsureSizedPropagatesReadSizedErrors(t *testing.T) {
408	427		fx := newFaviconFixture(t)
409	428		fx.seedOriginal([]byte("old"))


@@ -404,6 +404,25 @@ func TestFaviconObserveConversionErrorDoesNotMutateExistingAssets(t *testing.T)
404	}	404		}
405	}	405		}
406		406
		407	+	func TestFaviconObserveUnavailableWebPPreservesCachedAssets(t *testing.T) {
		408	+	fx := newFaviconFixture(t)
		409	+	fx.seedOriginal([]byte("old"))
		410	+	fx.blobs.png["example.com"] = []byte("old-png")
		411	+	fx.blobs.sized["example.com"] = map[int][]byte{32: []byte("old-32")}
		412	+	fx.converter.errByContentType = map[string]error{"image/webp": ErrFaviconMiss}
		413	+
		414	+	_, err := fx.uc.Observe(context.Background(), "https://example.com", "https://example.com/favicon.webp", []byte("webp"), favicon.SourceEngine, "image/webp")
		415	+	if !errors.Is(err, ErrFaviconMiss) {
		416	+	t.Fatalf("Observe err=%v, want favicon miss", err)
		417	+	}
		418	+	if string(fx.blobs.original["example.com"]) != "old" \|\| string(fx.blobs.png["example.com"]) != "old-png" \|\| string(fx.blobs.sized["example.com"][32]) != "old-32" {
		419	+	t.Fatalf("cached assets changed after unavailable WebP decoder")
		420	+	}
		421	+	if fx.blobs.writeOriginals != 0 \|\| fx.blobs.removeDerived != 0 \|\| fx.invalidators.calls != 0 {
		422	+	t.Fatalf("unavailable decoder mutated cache: writes=%d removes=%d invalidations=%d", fx.blobs.writeOriginals, fx.blobs.removeDerived, fx.invalidators.calls)
		423	+	}
		424	+	}
		425	+
407	func TestFaviconEnsureSizedPropagatesReadSizedErrors(t *testing.T) {	426		func TestFaviconEnsureSizedPropagatesReadSizedErrors(t *testing.T) {
408	fx := newFaviconFixture(t)	427		fx := newFaviconFixture(t)
409	fx.seedOriginal([]byte("old"))	428		fx.seedOriginal([]byte("old"))

M internal/infrastructure/favicon/converter.go +19 -7


@@ -16,17 +16,25 @@ import (
16	16		)
17	17
18	18		// ImageConverter converts safe favicon image formats into normalized PNGs.
19		-	type ImageConverter struct{}
	19	+	type ImageConverter struct {
	20	+	webp *webPDecoder
	21	+	}
	22	+
	23	+	func NewImageConverter() *ImageConverter { return &ImageConverter{webp: newDefaultWebPDecoder()} }
20	24
21		-	func NewImageConverter() *ImageConverter { return &ImageConverter{} }
	25	+	// newImageConverterWithWebPRuntime provides an infrastructure test seam while
	26	+	// application ports remain independent of the libwebp implementation.
	27	+	func newImageConverterWithWebPRuntime(runtime webpRuntime) *ImageConverter {
	28	+	return &ImageConverter{webp: newWebPDecoder(runtime)}
	29	+	}
22	30
23		-	func (ImageConverter) Convert(ctx context.Context, original []byte, contentType string, sizes []int) (appport.ConvertedFavicon, error) {
	31	+	func (c ImageConverter) Convert(ctx context.Context, original []byte, contentType string, sizes []int) (appport.ConvertedFavicon, error) {
24	32		_ = ctx
25	33		if len(original) == 0 {
26	34		return nil, fmt.Errorf("%w: empty image", appport.ErrFaviconMiss)
27	35		}
28	36
29		-	img, err := decodeFaviconImage(original, normalizeContentType(contentType))
	37	+	img, err := decodeFaviconImage(original, normalizeContentType(contentType), c.webp)
30	38		if err != nil {
31	39		return nil, err
32	40		}

@@ -48,7 +56,7 @@ func (*ImageConverter) Convert(ctx context.Context, original []byte, contentType
48	56		return out, nil
49	57		}
50	58
51		-	func decodeFaviconImage(data []byte, ct string) (image.Image, error) {
	59	+	func decodeFaviconImage(data []byte, ct string, webp *webPDecoder) (image.Image, error) {
52	60		switch ct {
53	61		case "image/svg+xml":
54	62		return nil, fmt.Errorf("%w: svg favicon conversion is disabled", appport.ErrFaviconMiss)

@@ -59,9 +67,13 @@ func decodeFaviconImage(data []byte, ct string) (image.Image, error) {
59	67		}
60	68		return img, nil
61	69		case "image/webp":
62		-	return nil, fmt.Errorf("%w: webp favicon conversion is disabled", appport.ErrFaviconMiss)
	70	+	img, err := webp.Decode(data)
	71	+	if err != nil {
	72	+	return nil, fmt.Errorf("%w: decode webp favicon: %w", appport.ErrFaviconMiss, err)
	73	+	}
	74	+	return img, nil
63	75		}
64		-	if ct != "" && ct != "image/png" && ct != "image/jpeg" && ct != "image/gif" && ct != "image/webp" {
	76	+	if ct != "" && ct != "image/png" && ct != "image/jpeg" && ct != "image/gif" {
65	77		return nil, fmt.Errorf("%w: unsupported favicon content type %s", appport.ErrFaviconMiss, ct)
66	78		}
67	79		img, _, err := image.Decode(bytes.NewReader(data))

 )
 // ImageConverter converts safe favicon image formats into normalized PNGs.
-type ImageConverter struct{}
+type ImageConverter struct {
+	webp *webPDecoder
+}
+func NewImageConverter() *ImageConverter { return &ImageConverter{webp: newDefaultWebPDecoder()} }
-func NewImageConverter() *ImageConverter { return &ImageConverter{} }
+// newImageConverterWithWebPRuntime provides an infrastructure test seam while
+// application ports remain independent of the libwebp implementation.
+func newImageConverterWithWebPRuntime(runtime webpRuntime) *ImageConverter {
+	return &ImageConverter{webp: newWebPDecoder(runtime)}
+}
-func (*ImageConverter) Convert(ctx context.Context, original []byte, contentType string, sizes []int) (*appport.ConvertedFavicon, error) {
+func (c *ImageConverter) Convert(ctx context.Context, original []byte, contentType string, sizes []int) (*appport.ConvertedFavicon, error) {
 	_ = ctx
 	if len(original) == 0 {
 		return nil, fmt.Errorf("%w: empty image", appport.ErrFaviconMiss)
 	}
-	img, err := decodeFaviconImage(original, normalizeContentType(contentType))
+	img, err := decodeFaviconImage(original, normalizeContentType(contentType), c.webp)
 	if err != nil {
 		return nil, err
 	}
 	return out, nil
 }
-func decodeFaviconImage(data []byte, ct string) (image.Image, error) {
+func decodeFaviconImage(data []byte, ct string, webp *webPDecoder) (image.Image, error) {
 	switch ct {
 	case "image/svg+xml":
 		return nil, fmt.Errorf("%w: svg favicon conversion is disabled", appport.ErrFaviconMiss)
 		}
 		return img, nil
 	case "image/webp":
-		return nil, fmt.Errorf("%w: webp favicon conversion is disabled", appport.ErrFaviconMiss)
+		img, err := webp.Decode(data)
+		if err != nil {
+			return nil, fmt.Errorf("%w: decode webp favicon: %w", appport.ErrFaviconMiss, err)
+		}
+		return img, nil
 	}
-	if ct != "" && ct != "image/png" && ct != "image/jpeg" && ct != "image/gif" && ct != "image/webp" {
+	if ct != "" && ct != "image/png" && ct != "image/jpeg" && ct != "image/gif" {
 		return nil, fmt.Errorf("%w: unsupported favicon content type %s", appport.ErrFaviconMiss, ct)
 	}
 	img, _, err := image.Decode(bytes.NewReader(data))

A internal/infrastructure/favicon/testdata/alpha.webp +0 -0 binary file: no text diff

binary file: no text diff

A internal/infrastructure/favicon/webp_decoder.go +93 -0

@@ -0,0 +1,93 @@
	1	+	package favicon
	2	+
	3	+	import (
	4	+	"errors"
	5	+	"image"
	6	+	"math"
	7	+
	8	+	"github.com/bnema/purego-webp/libwebp"
	9	+	)
	10	+
	11	+	const (
	12	+	// maxWebPInputBytes bounds untrusted compressed favicon input before it is
	13	+	// handed to libwebp.
	14	+	maxWebPInputBytes = 5 << 20
	15	+	// maxWebPDimension and maxWebPPixels bound the final RGBA allocation.
	16	+	maxWebPDimension = 4096
	17	+	maxWebPPixels = 4 << 20
	18	+	)
	19	+
	20	+	var (
	21	+	errWebPInputTooLarge = errors.New("webp favicon input exceeds size limit")
	22	+	errWebPImageTooLarge = errors.New("webp favicon dimensions exceed size limit")
	23	+	errWebPInvalidMetadata = errors.New("invalid webp favicon metadata")
	24	+	)
	25	+
	26	+	// webpRuntime is the narrow infrastructure seam around the dynamically loaded
	27	+	// libwebp binding. It deliberately exposes only Go values, keeping backend
	28	+	// types out of ports and the domain.
	29	+	type webpRuntime interface {
	30	+	Info(data []byte) (width, height int, err error)
	31	+	DecodeRGBAInto(data, pix []byte, stride, width, height int) error
	32	+	}
	33	+
	34	+	type libwebpRuntime struct{}
	35	+
	36	+	func (libwebpRuntime) Info(data []byte) (int, int, error) {
	37	+	width, height, ok, err := libwebp.WebPGetInfo(data)
	38	+	if err != nil {
	39	+	return 0, 0, err
	40	+	}
	41	+	if !ok {
	42	+	return 0, 0, errWebPInvalidMetadata
	43	+	}
	44	+	return width, height, nil
	45	+	}
	46	+
	47	+	func (libwebpRuntime) DecodeRGBAInto(data, pix []byte, stride, width, height int) error {
	48	+	return libwebp.WebPDecodeRGBAIntoWithInfo(data, pix, stride, width, height)
	49	+	}
	50	+
	51	+	// webPDecoder owns the failure boundary for the optional libwebp runtime.
	52	+	type webPDecoder struct{ runtime webpRuntime }
	53	+
	54	+	func newWebPDecoder(runtime webpRuntime) *webPDecoder { return &webPDecoder{runtime: runtime} }
	55	+
	56	+	func newDefaultWebPDecoder() *webPDecoder { return newWebPDecoder(libwebpRuntime{}) }
	57	+
	58	+	func (d webPDecoder) Decode(data []byte) (image.NRGBA, error) {
	59	+	if len(data) == 0 {
	60	+	return nil, errWebPInvalidMetadata
	61	+	}
	62	+	if len(data) > maxWebPInputBytes {
	63	+	return nil, errWebPInputTooLarge
	64	+	}
	65	+	if d == nil \|\| d.runtime == nil {
	66	+	return nil, errors.New("webp decoder unavailable")
	67	+	}
	68	+	width, height, err := d.runtime.Info(data)
	69	+	if err != nil {
	70	+	return nil, err
	71	+	}
	72	+	if width <= 0 \|\| height <= 0 {
	73	+	return nil, errWebPInvalidMetadata
	74	+	}
	75	+	if width > maxWebPDimension \|\| height > maxWebPDimension \|\| width > maxWebPPixels/height {
	76	+	return nil, errWebPImageTooLarge
	77	+	}
	78	+	if width > math.MaxInt/4 {
	79	+	return nil, errWebPImageTooLarge
	80	+	}
	81	+	stride := width * 4
	82	+	if height > math.MaxInt/stride {
	83	+	return nil, errWebPImageTooLarge
	84	+	}
	85	+
	86	+	// Allocate exactly the destination buffer used by libwebp; no native image
	87	+	// buffer or second decoded copy crosses this adapter boundary.
	88	+	img := image.NewNRGBA(image.Rect(0, 0, width, height))
	89	+	if err := d.runtime.DecodeRGBAInto(data, img.Pix, img.Stride, width, height); err != nil {
	90	+	return nil, err
	91	+	}
	92	+	return img, nil
	93	+	}

@@ -0,0 +1,93 @@
	1	+	package favicon
	2	+
	3	+	import (
	4	+	"errors"
	5	+	"image"
	6	+	"math"
	7	+
	8	+	"github.com/bnema/purego-webp/libwebp"
	9	+	)
	10	+
	11	+	const (
	12	+	// maxWebPInputBytes bounds untrusted compressed favicon input before it is
	13	+	// handed to libwebp.
	14	+	maxWebPInputBytes = 5 << 20
	15	+	// maxWebPDimension and maxWebPPixels bound the final RGBA allocation.
	16	+	maxWebPDimension = 4096
	17	+	maxWebPPixels = 4 << 20
	18	+	)
	19	+
	20	+	var (
	21	+	errWebPInputTooLarge = errors.New("webp favicon input exceeds size limit")
	22	+	errWebPImageTooLarge = errors.New("webp favicon dimensions exceed size limit")
	23	+	errWebPInvalidMetadata = errors.New("invalid webp favicon metadata")
	24	+	)
	25	+
	26	+	// webpRuntime is the narrow infrastructure seam around the dynamically loaded
	27	+	// libwebp binding. It deliberately exposes only Go values, keeping backend
	28	+	// types out of ports and the domain.
	29	+	type webpRuntime interface {
	30	+	Info(data []byte) (width, height int, err error)
	31	+	DecodeRGBAInto(data, pix []byte, stride, width, height int) error
	32	+	}
	33	+
	34	+	type libwebpRuntime struct{}
	35	+
	36	+	func (libwebpRuntime) Info(data []byte) (int, int, error) {
	37	+	width, height, ok, err := libwebp.WebPGetInfo(data)
	38	+	if err != nil {
	39	+	return 0, 0, err
	40	+	}
	41	+	if !ok {
	42	+	return 0, 0, errWebPInvalidMetadata
	43	+	}
	44	+	return width, height, nil
	45	+	}
	46	+
	47	+	func (libwebpRuntime) DecodeRGBAInto(data, pix []byte, stride, width, height int) error {
	48	+	return libwebp.WebPDecodeRGBAIntoWithInfo(data, pix, stride, width, height)
	49	+	}
	50	+
	51	+	// webPDecoder owns the failure boundary for the optional libwebp runtime.
	52	+	type webPDecoder struct{ runtime webpRuntime }
	53	+
	54	+	func newWebPDecoder(runtime webpRuntime) *webPDecoder { return &webPDecoder{runtime: runtime} }
	55	+
	56	+	func newDefaultWebPDecoder() *webPDecoder { return newWebPDecoder(libwebpRuntime{}) }
	57	+
	58	+	func (d webPDecoder) Decode(data []byte) (image.NRGBA, error) {
	59	+	if len(data) == 0 {
	60	+	return nil, errWebPInvalidMetadata
	61	+	}
	62	+	if len(data) > maxWebPInputBytes {
	63	+	return nil, errWebPInputTooLarge
	64	+	}
	65	+	if d == nil \|\| d.runtime == nil {
	66	+	return nil, errors.New("webp decoder unavailable")
	67	+	}
	68	+	width, height, err := d.runtime.Info(data)
	69	+	if err != nil {
	70	+	return nil, err
	71	+	}
	72	+	if width <= 0 \|\| height <= 0 {
	73	+	return nil, errWebPInvalidMetadata
	74	+	}
	75	+	if width > maxWebPDimension \|\| height > maxWebPDimension \|\| width > maxWebPPixels/height {
	76	+	return nil, errWebPImageTooLarge
	77	+	}
	78	+	if width > math.MaxInt/4 {
	79	+	return nil, errWebPImageTooLarge
	80	+	}
	81	+	stride := width * 4
	82	+	if height > math.MaxInt/stride {
	83	+	return nil, errWebPImageTooLarge
	84	+	}
	85	+
	86	+	// Allocate exactly the destination buffer used by libwebp; no native image
	87	+	// buffer or second decoded copy crosses this adapter boundary.
	88	+	img := image.NewNRGBA(image.Rect(0, 0, width, height))
	89	+	if err := d.runtime.DecodeRGBAInto(data, img.Pix, img.Stride, width, height); err != nil {
	90	+	return nil, err
	91	+	}
	92	+	return img, nil
	93	+	}

A internal/infrastructure/favicon/webp_decoder_test.go +92 -0

@@ -0,0 +1,92 @@
	1	+	package favicon
	2	+
	3	+	import (
	4	+	"bytes"
	5	+	"context"
	6	+	"errors"
	7	+	"image"
	8	+	"image/color"
	9	+	"image/png"
	10	+	"os"
	11	+	"testing"
	12	+
	13	+	appport "github.com/bnema/dumber/internal/application/port"
	14	+	)
	15	+
	16	+	func TestConverterWebPConvertsAlphaFixture(t *testing.T) {
	17	+	data, err := os.ReadFile("testdata/alpha.webp")
	18	+	if err != nil {
	19	+	t.Fatal(err)
	20	+	}
	21	+	conv := NewImageConverter()
	22	+	out, err := conv.Convert(context.Background(), data, "image/webp", []int{32})
	23	+	if err != nil {
	24	+	t.Fatal(err)
	25	+	}
	26	+	img, err := png.Decode(bytes.NewReader(out.PNG))
	27	+	if err != nil {
	28	+	t.Fatal(err)
	29	+	}
	30	+	if got := color.NRGBAModel.Convert(img.At(0, 0)).(color.NRGBA); got.A != 64 \|\| got.R != 255 {
	31	+	t.Fatalf("alpha pixel = %#v, want red alpha 64", got)
	32	+	}
	33	+	if sized, err := png.Decode(bytes.NewReader(out.SizedPNG[32])); err != nil \|\| sized.Bounds() != image.Rect(0, 0, 32, 32) {
	34	+	t.Fatalf("sized WebP = %v, %v", sized.Bounds(), err)
	35	+	}
	36	+	}
	37	+
	38	+	func TestConverterWebPFailuresAreFaviconMisses(t *testing.T) {
	39	+	for _, tc := range []struct {
	40	+	name string
	41	+	data []byte
	42	+	dec webpRuntime
	43	+	}{
	44	+	{name: "truncated", data: []byte("RIFF\x04\x00\x00\x00WEBPVP8 "), dec: &fakeWebPRuntime{infoErr: errors.New("truncated")}},
	45	+	{name: "unavailable", data: []byte("webp"), dec: &fakeWebPRuntime{infoErr: errors.New("libwebp unavailable")}},
	46	+	} {
	47	+	t.Run(tc.name, func(t *testing.T) {
	48	+	conv := newImageConverterWithWebPRuntime(tc.dec)
	49	+	if _, err := conv.Convert(context.Background(), tc.data, "image/webp", nil); !errors.Is(err, appport.ErrFaviconMiss) {
	50	+	t.Fatalf("err = %v, want favicon miss", err)
	51	+	}
	52	+	})
	53	+	}
	54	+	}
	55	+
	56	+	func TestWebPDecoderRejectsInputAndDecodedLimitsBeforeAllocation(t *testing.T) {
	57	+	for _, tc := range []struct {
	58	+	name string
	59	+	data []byte
	60	+	width, height int
	61	+	}{
	62	+	{name: "input", data: bytes.Repeat([]byte("x"), maxWebPInputBytes+1), width: 1, height: 1},
	63	+	{name: "dimension", data: []byte("webp"), width: maxWebPDimension + 1, height: 1},
	64	+	{name: "pixels", data: []byte("webp"), width: maxWebPDimension, height: maxWebPDimension},
	65	+	} {
	66	+	t.Run(tc.name, func(t *testing.T) {
	67	+	runtime := &fakeWebPRuntime{width: tc.width, height: tc.height}
	68	+	_, err := newWebPDecoder(runtime).Decode(tc.data)
	69	+	if err == nil {
	70	+	t.Fatal("Decode succeeded")
	71	+	}
	72	+	if runtime.decodeCalls != 0 {
	73	+	t.Fatalf("decode calls = %d, want no allocation/decode", runtime.decodeCalls)
	74	+	}
	75	+	})
	76	+	}
	77	+	}
	78	+
	79	+	type fakeWebPRuntime struct {
	80	+	width, height int
	81	+	infoErr error
	82	+	decodeCalls int
	83	+	}
	84	+
	85	+	func (r *fakeWebPRuntime) Info(_ []byte) (int, int, error) { return r.width, r.height, r.infoErr }
	86	+	func (r *fakeWebPRuntime) DecodeRGBAInto(_, pix []byte, _, _, _ int) error {
	87	+	r.decodeCalls++
	88	+	for i := range pix {
	89	+	pix[i] = 0xff
	90	+	}
	91	+	return nil
	92	+	}

@@ -0,0 +1,92 @@
	1	+	package favicon
	2	+
	3	+	import (
	4	+	"bytes"
	5	+	"context"
	6	+	"errors"
	7	+	"image"
	8	+	"image/color"
	9	+	"image/png"
	10	+	"os"
	11	+	"testing"
	12	+
	13	+	appport "github.com/bnema/dumber/internal/application/port"
	14	+	)
	15	+
	16	+	func TestConverterWebPConvertsAlphaFixture(t *testing.T) {
	17	+	data, err := os.ReadFile("testdata/alpha.webp")
	18	+	if err != nil {
	19	+	t.Fatal(err)
	20	+	}
	21	+	conv := NewImageConverter()
	22	+	out, err := conv.Convert(context.Background(), data, "image/webp", []int{32})
	23	+	if err != nil {
	24	+	t.Fatal(err)
	25	+	}
	26	+	img, err := png.Decode(bytes.NewReader(out.PNG))
	27	+	if err != nil {
	28	+	t.Fatal(err)
	29	+	}
	30	+	if got := color.NRGBAModel.Convert(img.At(0, 0)).(color.NRGBA); got.A != 64 \|\| got.R != 255 {
	31	+	t.Fatalf("alpha pixel = %#v, want red alpha 64", got)
	32	+	}
	33	+	if sized, err := png.Decode(bytes.NewReader(out.SizedPNG[32])); err != nil \|\| sized.Bounds() != image.Rect(0, 0, 32, 32) {
	34	+	t.Fatalf("sized WebP = %v, %v", sized.Bounds(), err)
	35	+	}
	36	+	}
	37	+
	38	+	func TestConverterWebPFailuresAreFaviconMisses(t *testing.T) {
	39	+	for _, tc := range []struct {
	40	+	name string
	41	+	data []byte
	42	+	dec webpRuntime
	43	+	}{
	44	+	{name: "truncated", data: []byte("RIFF\x04\x00\x00\x00WEBPVP8 "), dec: &fakeWebPRuntime{infoErr: errors.New("truncated")}},
	45	+	{name: "unavailable", data: []byte("webp"), dec: &fakeWebPRuntime{infoErr: errors.New("libwebp unavailable")}},
	46	+	} {
	47	+	t.Run(tc.name, func(t *testing.T) {
	48	+	conv := newImageConverterWithWebPRuntime(tc.dec)
	49	+	if _, err := conv.Convert(context.Background(), tc.data, "image/webp", nil); !errors.Is(err, appport.ErrFaviconMiss) {
	50	+	t.Fatalf("err = %v, want favicon miss", err)
	51	+	}
	52	+	})
	53	+	}
	54	+	}
	55	+
	56	+	func TestWebPDecoderRejectsInputAndDecodedLimitsBeforeAllocation(t *testing.T) {
	57	+	for _, tc := range []struct {
	58	+	name string
	59	+	data []byte
	60	+	width, height int
	61	+	}{
	62	+	{name: "input", data: bytes.Repeat([]byte("x"), maxWebPInputBytes+1), width: 1, height: 1},
	63	+	{name: "dimension", data: []byte("webp"), width: maxWebPDimension + 1, height: 1},
	64	+	{name: "pixels", data: []byte("webp"), width: maxWebPDimension, height: maxWebPDimension},
	65	+	} {
	66	+	t.Run(tc.name, func(t *testing.T) {
	67	+	runtime := &fakeWebPRuntime{width: tc.width, height: tc.height}
	68	+	_, err := newWebPDecoder(runtime).Decode(tc.data)
	69	+	if err == nil {
	70	+	t.Fatal("Decode succeeded")
	71	+	}
	72	+	if runtime.decodeCalls != 0 {
	73	+	t.Fatalf("decode calls = %d, want no allocation/decode", runtime.decodeCalls)
	74	+	}
	75	+	})
	76	+	}
	77	+	}
	78	+
	79	+	type fakeWebPRuntime struct {
	80	+	width, height int
	81	+	infoErr error
	82	+	decodeCalls int
	83	+	}
	84	+
	85	+	func (r *fakeWebPRuntime) Info(_ []byte) (int, int, error) { return r.width, r.height, r.infoErr }
	86	+	func (r *fakeWebPRuntime) DecodeRGBAInto(_, pix []byte, _, _, _ int) error {
	87	+	r.decodeCalls++
	88	+	for i := range pix {
	89	+	pix[i] = 0xff
	90	+	}
	91	+	return nil
	92	+	}

A vendor/github.com/bnema/purego-webp/LICENSE +21 -0 generated file: collapsed

load diff

A vendor/github.com/bnema/purego-webp/internal/libwebp/generated_symbols.go +513 -0 generated file: collapsed

load diff

A vendor/github.com/bnema/purego-webp/internal/libwebp/loader.go +86 -0 generated file: collapsed

load diff

A vendor/github.com/bnema/purego-webp/internal/libwebp/types.go +164 -0 generated file: collapsed

load diff

A vendor/github.com/bnema/purego-webp/libwebp/libwebp.go +880 -0 generated file: collapsed

load diff

M vendor/modules.txt +4 -0 generated file: collapsed

load diff