php – base64编码图像的安全问题

我担心如果在尝试创建缩略图之前我没有正确验证POST有效内容的内容,恶意代码就会被执行.

我到目前为止的基本工作流程如下.是否有足够的验证,我不需要担心安全性？我想我担心某人编码不好的东西,然后当调用下面的图像函数之一时,互联网就会爆炸.

<?php

$decodedImage = base64_decode($_POST["canvas"]);
if ($decodedImage === false) {
    // Error out
}

$imageSizeValidation = getimagesizefromstring($decodedImage);
if ($imageSizeValidation[0] < 1 || $imageSizeValidation[1] < 1 || !$imageSizeValidation['mime']) {
    // Error out
}

$tempFilePath = "/tmp/" . microtime(true) . "-canvas-web.jpg";
file_put_contents($tempFilePath,$decodedImage);

$originalWidth = $imageSizeValidation[0];
$originalHeight = $imageSizeValidation[1];
$newWidth = 49;
$newHeight = 49;

$scaleWidth = $newWidth / $originalWidth;
$scaleHeight = $newHeight / $originalHeight;
$scale = min($scaleWidth,$scaleHeight);

$width = (int)($originalWidth * $scale);
$height = (int)($originalHeight * $scale);

$xpos = (int)(($newWidth - $width) / 2);
$ypos = (int)(($newHeight - $height) / 2);

$oldImage = imagecreatefromjpeg($tempFilePath);
$newImage = imagecreatetruecolor($width,$height);
$background = imagecolorallocate($oldImage,255,255);

imagefilledrectangle($newImage,$width,$height,$background);

imagecopyresampled($newImage,$oldImage,$xpos,$ypos,$originalWidth,$originalHeight);
imagedestroy($oldImage);

imagejpeg($newImage,"/path/to/new.jpg",90);

imagedestroy($newImage);