[FIX] web: prevent crash on image resize/crop

When attempting to resize or crop an attachment through the '/web/image'
route, if the attachment isn't actually an image (even if the record's
mimetype says so) or doesn't match one of the format supported by PIL
(Python Imaging Library) - like Apple's HEIF -  the request crashes with
a "500 Internal Error".

Although it makes sense to return a response with an HTTP error code, a
more sensible approach would be to return a "404 Not Found" response
instead.

The point by handling the Exception thrown by PIL and returning a 404
status code is to more closely match the semantic of this HTTP status
code. Getting a resized version of a non-image doesn't really make sense
as this resource doesn't exist at all ; hence the "404 Not Found"
response. On the other hand returning a "500 Internal Error" would
denote that a legitimate request failed on the server side, which is not
the case here.

Note: this difference of semantic, even if only visible in a regular
browser, has its importance in the mobile apps because we use it to
given a meaningful feedback to the user in case if failed HTTP requests.

Note: the mimetype detection could be improved to ease the handling of
this kind of errors but would require too much changes to be done in
stable branch.

Steps to reproduce in Discuss:
- rename an HEIF file with a ".jpeg" extension
- upload it in a chat window
=> the thumbnail in the chat window throws an HTTP error 500

opw-2417172

closes odoo/odoo#63767

X-original-commit: 873bc2aa5a8fcfc0664fc5ca70f789911873d583
Related: odoo/enterprise#15456
Signed-off-by: Pierre Paridans <pparidans@users.noreply.github.com>
Signed-off-by: Adrien Dieudonné (adr) <adr@odoo.com>

1 files changed, 4 insertions, 1 deletions

diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py
index 13f0124e3d9..b15247f1ccd 100644
--- a/addons/web/controllers/main.py
+++ b/addons/web/controllers/main.py
@@ -1532,7 +1532,10 @@ class Binary(http.Controller):
             if not (width or height):
                 width, height = odoo.tools.image_guess_size_from_field_name(field)
 
-        image_base64 = image_process(image_base64, size=(int(width), int(height)), crop=crop, quality=int(quality))
+        try:
+            image_base64 = image_process(image_base64, size=(int(width), int(height)), crop=crop, quality=int(quality))
+        except Exception:
+            return request.not_found()
 
         content = base64.b64decode(image_base64)
         headers = http.set_safe_image_headers(headers, content)