Re: Introduce contributor badges

Hi

On Fri, 16 Oct 2026 at 09:59, Christoph Berg <myon(at)debian(dot)org> wrote:

>
> > 6. **Oversized images are decoded in full (a "decompression bomb").**
> > `ImageBinaryField.to_python` decodes the entire image with Pillow before
> > rescaling. A PNG under 1 MB can still be about 170 megapixels before
> Pillow
> > refuses it, which is several hundred MB of RAM plus a bicubic resize on
> the
> > app server. `ModelForm` full-clean also re-parses the stored image on
> every
> > badge edit, even when the image hasn't changed. Only managers of an
> > approved organisation can upload, so the risk is moderate, but checking
> > `img.size` before decoding would be cheap.
>
> What max input size would we accept? 2000x2000 (4 megapixels) should
> be pretty much enough for everyone?
>

These are images for badges - why on earth do they have to be that big? You
pad them and then display them at 150x150 from what I can see. All of that
seems like work that needn't be done by our servers - I would have the user
upload at <= 256x256 or something (and adjust max_length to something more
reasonable), and then pad and resize them in CSS. Which looks like it might
be broken anyway - .badges-grid uses minmax(150px, 1fr) with img { width:
100% }, so on wide layouts a 150px image likely gets stretched beyond its
real size.

--
Dave Page
pgAdmin: https://www.pgadmin.org
PostgreSQL: https://www.postgresql.org
pgEdge: https://www.pgedge.com