Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

With all remotePatterns allowed for images, some image URLs are still rejected #60483

Closed
1 task done
WillCalderwood opened this issue Jan 10, 2024 · 3 comments · Fixed by #60488
Closed
1 task done
Labels
bug Issue was opened via the bug report template. Image (next/image) Related to Next.js Image Optimization. locked

Comments

@WillCalderwood
Copy link

Link to the code that reproduces this issue

https://github.com/WillCalderwood/next-bug

To Reproduce

  1. Start the application and you'll receive the error
Error: Invalid src prop [(https://bioage.typepad.com/.a/6a00d8341c4fbe53ef02c8d3a82122200d-600wi)](http://localhost:3000/admin/news/(https://bioage.typepad.com/.a/6a00d8341c4fbe53ef02c8d3a82122200d-600wi)) on `next/image`, hostname "bioage.typepad.com" is not configured under images in your `next.config.js`
See more info: https://nextjs.org/docs/messages/next-image-unconfigured-host

Current vs. Expected behavior

The image https://bioage.typepad.com/.a/6a00d8341c4fbe53ef02c8d3a82122200d-600wi is not allowed when all image remotes are set as valid with:

 images: {
    remotePatterns: [
      {
        protocol: "https",
        hostname: "**",
      },
      {
        protocol: "http",
        hostname: "**",
      },
    ],
  },

The image should not be throwing an error.

Note: It works correctly with unoptimized={true} specified.

Verify canary release

  • I verified that the issue exists in the latest Next.js canary release

Provide environment information

Operating System:
  Platform: win32
  Arch: x64
  Version: Windows 10 Pro
Binaries:
  Node: 20.8.1
  npm: N/A
  Yarn: N/A
  pnpm: N/A
Relevant Packages:
  next: 14.0.5-canary.47
  eslint-config-next: 14.0.4
  react: 18.2.0
  react-dom: 18.2.0
  typescript: 5.3.3
Next.js Config:
  output: N/A

Which area(s) are affected? (Select all that apply)

Image optimization (next/image, next/legacy/image)

Which stage(s) are affected? (Select all that apply)

Vercel (Deployed)

Additional context

No response

@WillCalderwood WillCalderwood added the bug Issue was opened via the bug report template. label Jan 10, 2024
@github-actions github-actions bot added the Image (next/image) Related to Next.js Image Optimization. label Jan 10, 2024
@coltonehrman
Copy link
Contributor

coltonehrman commented Jan 10, 2024

@WillCalderwood Seems to be a "qwerk" with the micromatch lib which is used to generate a RegEx based on globs. I messed around with this a bit and was able to produce a working pathname glob for this URL. This issue is the dot . inside the pathname.

module.exports = {
  images: {
    remotePatterns: [
      {
        protocol: 'https',
        hostname: '**',
        pathname: '/.*/**',
      },
      {
        protocol: 'http',
        hostname: '**',
        pathname: '/.*/**',
      },
    ],
  },
}

@flyingn1nja
Copy link

flyingn1nja commented Feb 3, 2024

@WillCalderwood Seems to be a "qwerk" with the micromatch lib which is used to generate a RegEx based on globs. I messed around with this a bit and was able to produce a working pathname glob for this URL. This issue is the dot . inside the pathname.

module.exports = {
  images: {
    remotePatterns: [
      {
        protocol: 'https',
        hostname: '**',
        pathname: '/.*/**',
      },
      {
        protocol: 'http',
        hostname: '**',
        pathname: '/.*/**',
      },
    ],
  },
}

I tried:

  images: {
    remotePatterns: [
      {
        protocol: 'https',
        hostname: '**',
        pathname: '/.*/**',
      },
      {
        protocol: 'http',
        hostname: '**',
        pathname: '/.*/**',
      },
    ],
  },

But unfortunately does not work. Do you have any other solutions?

EDIT:
Sorry, of course it does not work. I have different url structure. This is how my url looks like.

https://raw.githubusercontent.com/balabla/something-something-list/main/src/something-assets/aa.jpg

styfle added a commit that referenced this issue Feb 8, 2024
…60488)

### Fixing a bug

### What?
Fix remotePatterns when all paths and/or domains are allowed.

### Why?

micromatch creates a very strange regex for all paths -
`/^(?:(?!\.)(?:(?:(?!(?:^|[\\/])\.).)*?)[\\/]?)$/`. That is, paths
cannot start with a dot or contain a slash followed by a dot.

Interestingly, here are some valid paths:

- /a/a.a/6a00d8341c4fbe53ef02c8d3a82122200d-600wi
- ////a/a.a/6a00d8341c4fbe53ef02c8d3a82122200d-600wi
- ///:?%;№%/a/a.a/6a00d8341c4fbe53ef02c8d3a82122200d-600wi.\/
- /:./6a00d8341c4fbe53ef02c8d3a82122200d-600wi.\/

And here are some invalid ones:

- /.a/6a00d8341c4fbe53ef02c8d3a82122200d-600wi
- /a/.a/6a00d8341c4fbe53ef02c8d3a82122200d-600wi
- ./a/6a00d8341c4fbe53ef02c8d3a82122200d-600wi

I don't think this check makes any sense.

### How?

If the user allows all (`**`) - it means any path or domain will be
considered valid.

- Fixes #60483
- Fixes #58139
- Fixes #46903

---------

Co-authored-by: Steven <steven@ceriously.com>
Copy link
Contributor

This closed issue has been automatically locked because it had no new activity for 2 weeks. If you are running into a similar issue, please create a new issue with the steps to reproduce. Thank you.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Feb 23, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
bug Issue was opened via the bug report template. Image (next/image) Related to Next.js Image Optimization. locked
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants