Recognize avatar content type by ourselves without libmagic #2365
Conversation
|
Label error. Requires exactly 1 of: breaking, build, chore, ci, docs, feat, fix, perf, refactor, style, test. Found: dependencies. Follow https://www.conventionalcommits.org to get auto-labeling to work correctly. |
| return None | ||
| # We assume the image is one of supported formats | ||
| # https://docs.atlassian.com/software/jira/docs/api/REST/9.14.0/#api/2/project-storeTemporaryAvatar | ||
| if buff[:3] == b"\xff\xd8\xff": |
There was a problem hiding this comment.
did you investigate teh filetype package?
There was a problem hiding this comment.
Yes. It is mentioned in #1847 with a concern about it's maintenance. Also #1867 raises several concerns. On #1867 @ssbarnea commented on a plan to review and remove dependencies.
Jira supports a limited set of file types that are quite simple to tell apart. I expect any other MIME-types to be rejected by Jira. If Jira does not validate input, it could be a potential security issue on Jira.
Therefore I find that any dependency with wider support for file types does not add anything beyond this simple MIME-type discovery.
In my opinion, when use of a dependency is a larger and more complex problem than the root problem being solved, the solution does not need to be delegated to the dependency.
Do you know of any Jira instance that would accept any other MIME types to warrant a dependency that supports lots of MIME types?
The magic package for libmagic support has many different implementations that conflict with each other. For the avatar only JPEG, GIF and PNG are supported in Jira Could REST API and also BMP and WBMP for Data Center, so we can decide which it is ourselves.
The magic package for libmagic support has many different implementations that conflict with each other and I believe do not work on Windows. For the avatar only JPEG, GIF and PNG are supported in Jira Could REST API and also BMP and WBMP for Data Center, so we can decide which it is ourselves.
The
tempfilecode did not work because on Linux the temporary file is created withO_TMPFILEand the filenameis integer for the file descriptor.This replaces solutions in #1847 #1867, #1891 and closes #1801 which should have been closed already.