fix(t244): accept headerless ERP images safely

backend-api/internal/platform/shunyunbao/image.go

@@ -1,7 +1,11 @@
 package shunyunbao
 
 import (
+	"bufio"
+	"bytes"
 	"context"
+	"errors"
+	"io"
 	"mime"
 	"net/http"
 	"net/url"
@@ -15,6 +19,7 @@ import (
 const (
 	ProductImagePath     = "/api/p/file"
 	maxProductImageBytes = 20 << 20
+	productImageSniffLen = 512
 )
 
 func (manager *SessionManager) FetchProductImage(
@@ -86,11 +91,17 @@ func (manager *SessionManager) FetchProductImage(
 				domain.ErrFreightSourceUnavailable
 		}
 	}
-	mediaType, _, err := mime.ParseMediaType(
+	if response.ContentLength > maxProductImageBytes {
+		response.Body.Close()
+		manager.logERPBinaryResponse(request, response)
+		return usecase.FreightSourceImage{},
+			domain.ErrFreightImageInvalid
+	}
+	mediaType, content, err := productImageContent(
 		response.Header.Get("Content-Type"),
+		response.Body,
 	)
-	if err != nil || !supportedProductImageType(mediaType) ||
-		response.ContentLength > maxProductImageBytes {
+	if err != nil {
 		response.Body.Close()
 		manager.logERPBinaryResponse(request, response)
 		return usecase.FreightSourceImage{},
@@ -98,11 +109,64 @@ func (manager *SessionManager) FetchProductImage(
 	}
 	manager.logERPBinaryResponse(request, response)
 	return usecase.FreightSourceImage{
-		Content:   response.Body,
+		Content:   content,
 		MediaType: mediaType,
 	}, nil
 }
 
+func productImageContent(
+	contentType string,
+	body io.ReadCloser,
+) (string, io.ReadCloser, error) {
+	contentType = strings.TrimSpace(contentType)
+	if contentType != "" {
+		mediaType, _, err := mime.ParseMediaType(contentType)
+		if err != nil {
+			return "", nil, err
+		}
+		mediaType = strings.ToLower(mediaType)
+		if supportedProductImageType(mediaType) {
+			return mediaType, body, nil
+		}
+		if mediaType != "application/octet-stream" {
+			return "", nil, domain.ErrFreightImageInvalid
+		}
+	}
+
+	reader := bufio.NewReaderSize(body, productImageSniffLen)
+	prefix, err := reader.Peek(productImageSniffLen)
+	if err != nil && !errors.Is(err, io.EOF) {
+		return "", nil, err
+	}
+	if len(prefix) == 0 {
+		return "", nil, domain.ErrFreightImageInvalid
+	}
+	mediaType := detectProductImageType(prefix)
+	if !supportedProductImageType(mediaType) {
+		return "", nil, domain.ErrFreightImageInvalid
+	}
+	return mediaType, struct {
+		io.Reader
+		io.Closer
+	}{
+		Reader: reader,
+		Closer: body,
+	}, nil
+}
+
+func detectProductImageType(prefix []byte) string {
+	mediaType := strings.ToLower(http.DetectContentType(prefix))
+	if supportedProductImageType(mediaType) {
+		return mediaType
+	}
+	if len(prefix) >= 12 &&
+		bytes.Equal(prefix[:4], []byte("RIFF")) &&
+		bytes.Equal(prefix[8:12], []byte("WEBP")) {
+		return "image/webp"
+	}
+	return mediaType
+}
+
 func supportedProductImageType(value string) bool {
 	switch strings.ToLower(value) {
 	case "image/jpeg", "image/png", "image/webp":