From 24b7b3f37fa59762f15c2b310c91e8e48f7f1ee7 Mon Sep 17 00:00:00 2001
From: John Niang <johnniang@foxmail.com>
Date: Fri, 26 Sep 2025 16:59:45 +0800
Subject: [PATCH] Enhance thumbnail processing by validating upload paths and
 updating image size attributes

---
 .../ThumbnailImgTagPostProcessor.java         | 19 ++++++++++++-------
 .../attachment/endpoint/ThumbnailRouters.java |  2 ++
 2 files changed, 14 insertions(+), 7 deletions(-)

diff --git a/application/src/main/java/run/halo/app/core/attachment/ThumbnailImgTagPostProcessor.java b/application/src/main/java/run/halo/app/core/attachment/ThumbnailImgTagPostProcessor.java
index 5e383c147..ea5020bd5 100644
--- a/application/src/main/java/run/halo/app/core/attachment/ThumbnailImgTagPostProcessor.java
+++ b/application/src/main/java/run/halo/app/core/attachment/ThumbnailImgTagPostProcessor.java
@@ -78,6 +78,12 @@ class ThumbnailImgTagPostProcessor implements ElementTagPostProcessor {
             }
         }
 
+        var path = imageUri.getPath();
+        if (!path.startsWith("/upload/")) {
+            log.debug("Skip processing img tag with non-upload path: {}", path);
+            return Mono.empty();
+        }
+
         var fileSuffix = FilenameUtils.getExtension(imageUri.getPath());
         if (!ThumbnailUtils.isSupportedImage(fileSuffix)) {
             log.debug("Skip processing img tag with unsupported image suffix: {}", fileSuffix);
@@ -90,14 +96,13 @@ class ThumbnailImgTagPostProcessor implements ElementTagPostProcessor {
             log.debug("Skip processing img tag because the image is not supported: {}", imageUri);
             return Mono.empty();
         }
-        var modelFactory = context.getModelFactory();
-        tag = modelFactory.setAttribute(tag, "size", """
-            (max-width: 400px) 400px, \
-            (max-width: 800px) 800px, \
-            (max-width: 1200px) 1200px, \
-            (max-width: 1600px) 1600px\
-            """);
 
+        var modelFactory = context.getModelFactory();
+        if (!tag.hasAttribute("sizes")) {
+            tag = modelFactory.setAttribute(tag, "sizes", """
+                (min-width: 1024px) 33vw, (min-width: 600px) 50vw, 100vw\
+                """);
+        }
         var srcset = thumbnails.keySet().stream()
             .map(size -> {
                 var uri = thumbnails.get(size);
diff --git a/application/src/main/java/run/halo/app/core/attachment/endpoint/ThumbnailRouters.java b/application/src/main/java/run/halo/app/core/attachment/endpoint/ThumbnailRouters.java
index 3147085eb..b580391d5 100644
--- a/application/src/main/java/run/halo/app/core/attachment/endpoint/ThumbnailRouters.java
+++ b/application/src/main/java/run/halo/app/core/attachment/endpoint/ThumbnailRouters.java
@@ -7,6 +7,7 @@ import java.nio.file.Files;
 import java.nio.file.Path;
 import javax.imageio.ImageIO;
 import lombok.extern.slf4j.Slf4j;
+import net.coobird.thumbnailator.ThumbnailParameter;
 import net.coobird.thumbnailator.Thumbnails;
 import org.apache.commons.io.FilenameUtils;
 import org.apache.commons.lang3.StringUtils;
@@ -126,6 +127,7 @@ class ThumbnailRouters {
                 Files.createDirectories(thumbnailPath.getParent());
                 Thumbnails.of(bufferedImage)
                     .width(size.getWidth())
+                    .imageType(ThumbnailParameter.DEFAULT_IMAGE_TYPE)
                     .toFile(thumbnailPath.toFile());
                 log.info("Generated thumbnail for path: {}, target: {}, size: {}",
                     attachmentPath, thumbnailPath, size);