fix(weixin): check full 4-byte PNG magic signature (#2970)

PNG's magic bytes are 89 50 4E 47, but detectImageMime only checked
the first three. The WebP branch in the same function correctly checks
all four bytes of its signature — the PNG path was clearly an oversight.
Extend the PNG check to include 0x47 ('G') for consistency and to
eliminate the (admittedly rare) false-positive window.
This commit is contained in:
chinesepowered 2026-04-17 18:32:58 -07:00 committed by GitHub
parent c012462514
commit 9a420d0fce
No known key found for this signature in database
GPG key ID: B5690EEEBB952194

View file

@ -205,7 +205,12 @@ export class WeixinChannel extends ChannelBase {
/** Detect image MIME type from magic bytes. */
function detectImageMime(data: Buffer): string {
if (data[0] === 0x89 && data[1] === 0x50 && data[2] === 0x4e) {
if (
data[0] === 0x89 &&
data[1] === 0x50 &&
data[2] === 0x4e &&
data[3] === 0x47
) {
return 'image/png';
}
if (data[0] === 0x47 && data[1] === 0x49 && data[2] === 0x46) {