MIME タイプを使用して埋め込み画像を検出する

Add setting to disable hotlinking of large image files の議論に続きます:

拡張子ではなく、MIME タイプによる画像の検出を提案したいと考えています。

ユースケース:

行に JPG の URL を置きます:

ファイルには JPG 拡張子がありませんが、content-type が正しく送信されているため、Discourse がこれを自動的に img タグに更新し、インライン表示し、さらにホットリンクすることを望んでいます。

現在のところ拡張子から行われているワンボックス化(img タグへの更新)のための写真検出を、MIME タイプから行うことが有益だと考えます。

「いいね!」 6

Easy to work around though just add ?x=.jpg to the end of any URL.

https://freecannabis.com/media/dscf1924.36/full?x=.jpg

「いいね!」 1

Thanks. But that doesn’t quite solve the problem. I’m already using workaround to add img tag manually. My users are not technically skilled so automatic form of hotlinking would be great.

I think it is super bad form to have images that look like HTML web pages so I would object to this being supported as it encourages super bad web hosting habits.

「いいね!」 1

I agree it is bad practice of the image hoster, but you know - " be tolerant in what you accept "

And second, we already are pinging the URL, so why not use it to our benefit?

[edit]
Funny side note: I’ve just found that image hoster is using Xenforo Media Gallery paid plugin :slight_smile:

「いいね!」 2

I’m going to disagree with you here. When you get the “Content-Type:” header, that’s when you know what you are dealing with. Otherwise a URL without an extension doesn’t look like anything, not “looks like HTML”.

This is how content negotiation on the web is supposed to work. I should be able to make a directory full of files, and return different versions of them depending on the “Accept” headers the browser offers. If you don’t explicitly say “Accept: image/x-mycoolformat”, but just a “Accept: /”, then maybe I want to hand you image/jpeg, but otherwise give you mycoolformat.

「いいね!」 1

By that logic, page titles and urls also don’t matter. But we all know they do. So I violently disagree on this point.

Page titles have many uses, eg distinguishing tabs and titling bookmarks. URLs matter only because Google thinks they should. But I won’t press the point further.