coinos-server.git/lib/image-worker.ts, branch mastercoinos server — legacy coinos.io backend (Lightning, on-chain, Liquid)https://git.coinos.io/coinos-server.git/atom?h=master2026-09-27T05:45:43Zupload: decode images in a throwaway child process and tighten input checks2026-09-27T05:45:43ZAdam Soltysadam@coinos.io2026-09-27T05:45:43Zurn:sha1:0912f443cc738af7dd7093670f00420de72a095f
Malformed HEIF uploads were corrupting the heap inside libvips/libheif and
taking the whole app down with them, since sharp ran in-process. Move the
decode into a per-upload child (lib/image-worker.ts, spawned by lib/image.ts
with a hard timeout) so a decoder crash fails one request instead of the
server, and never load sharp in the main process.
Also: only accept jpeg/png/webp/gif as sniffed by file-type instead of any
image/* subtype, decode with failOnError and a pixel cap, refuse uploads
from blacklisted accounts (a freeze previously only blocked sends), and
rate-limit uploads per account.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>