Opened 3 months ago

Last modified 2 months ago

#7442 new defect (bug)

GitHub PR images not displayed

Reported by: dd32's profile dd32 Owned by:
Milestone: Priority: normal
Component: Trac Keywords:


As of a few weeks ago (at least) GitHub images in PRs are no longer being displayed on trac.

For example:

In that example, I've edited the first image listed from proxying via Jetpack Photon to using the image URL directly.

This appears to be that the GitHub API is blocking Jetpack Photon from re-publishing the images.

For example; gives a 403 response.

Looking at the Photon source, we can see that the specific 403 presented means the upstream returned a 403 too.

Why do we proxy images via Photon?

Photon is in front of GitHub primarily as it doesn't expose CORS headers. Why do we need CORS headers? Well, because we have <img crossorigin="anonymous" /> such that the embedded content isn't requested with credentials and doesn't attempt to display any external-url basic authentication prompts.

Realistically, we can probably remove the usage of Photon here, by removing the use of crossorigin=anonymous for, as we trust github not to present a HTTP Authorization request, and as the content is within an <img> element there shouldn't be any possibility of malicious content within a GitHub attachment being able to be access the trac page DOM.

I'm not 100% positive on that though.

Trac does offer a safe list of URIs that should not get crossorigin=false attributes, we can possibly just add GitHub to that.

upstream refs: +

Change History (1)

#1 @dd32
2 months ago

In 13213:

Trac: Github PRs: Load GitHub embedded images directly, avoiding CORS.

See #7442.

Note: See TracTickets for help on using tickets.