ghost 3.42.7 → 3.42.8

package/core/frontend/helpers/url.js

@@ -11,7 +11,12 @@ module.exports = function url(options) {
     const absolute = options && options.hash.absolute && options.hash.absolute !== 'false';
     let outputUrl = getMetaDataUrl(this, absolute);
 
-    outputUrl = encodeURI(decodeURI(outputUrl));
+    try {
+        outputUrl = encodeURI(decodeURI(outputUrl));
+    } catch (err) {
+        // Happens when the outputURL contains an invalid URI character like "%%" or "%80"
+        return new SafeString('');
+    }
 
     return new SafeString(outputUrl);
 };

package/core/server/services/oembed.js

@@ -85,6 +85,8 @@ class OEmbed {
     }
 
     async fetchBookmarkData(url) {
+        // Metascraper doesn't handle leading/trailing whitespace
+        url = url.trim();
         const metascraper = require('metascraper')([
             require('metascraper-url')(),
             require('metascraper-title')(),
@@ -154,6 +156,10 @@ class OEmbed {
     }
 
     fetchOembedData(_url, cardType) {
+        // Trimming solves the difference of url validation between `new URL(url)`
+        // and metascraper.
+        _url = _url.trim();
+
         // parse the url then validate the protocol and host to make sure it's
         // http(s) and not an IP address or localhost to avoid potential access to
         // internal network endpoints

package/core/server/web/site/middleware/handle-image-sizes.js

@@ -1,5 +1,6 @@
 const _ = require('lodash');
 const path = require('path');
+const {GhostError} = require('@tryghost/errors');
 const imageTransform = require('@tryghost/image-transform');
 const storage = require('../../../adapters/storage');
 const activeTheme = require('../../../../frontend/services/themes/active');
@@ -100,6 +101,12 @@ module.exports = function (req, res, next) {
                 return storageInstance.read({path: storagePath});
             })
             .then((originalImageBuffer) => {
+                if (originalImageBuffer.length <= 0) {
+                    throw new GhostError({
+                        errorType: 'NoContentError',
+                        statusCode: 204
+                    });
+                }
                 return imageTransform.resizeFromBuffer(originalImageBuffer, imageDimensionConfig);
             })
             .then((resizedImageBuffer) => {
@@ -108,7 +115,7 @@ module.exports = function (req, res, next) {
     }).then(() => {
         next();
     }).catch(function (err) {
-        if (err.code === 'SHARP_INSTALLATION') {
+        if (err.code === 'SHARP_INSTALLATION' || err.code === 'IMAGE_PROCESSING' || err.errorType === 'NoContentError') {
             return redirectToOriginal();
         }
         next(err);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ghost",
-  "version": "3.42.7",
+  "version": "3.42.8",
   "description": "The professional publishing platform",
   "author": "Ghost Foundation",
   "homepage": "https://ghost.org",