#398

backend/app/services/preview/thumbnail_fetcher.rb

@@ -1,6 +1,9 @@
 module Preview
   class ThumbnailFetcher
     class GenerationFailed < StandardError; end
+    ALLOWED_IMAGE_CONTENT_TYPES = [
+      'image/jpeg', 'image/png', 'image/gif', 'image/webp'
+    ].freeze
     HTML_MAX_BYTES = 1.megabyte
     NICONICO_XML_MAX_BYTES = 256.kilobytes
 
@@ -32,7 +35,7 @@ module Preview
       return nil if url.blank?
 
       response = HttpFetcher.fetch(url)
-      return nil unless response.content_type.downcase.start_with?('image/')
+      return nil unless allowed_image_content_type?(response.content_type)
 
       response.body
     rescue HttpFetcher::FetchTimeout
@@ -43,7 +46,7 @@ module Preview
 
     def self.fetch_image!(url)
       response = HttpFetcher.fetch(url)
-      unless response.content_type.downcase.start_with?('image/')
+      unless allowed_image_content_type?(response.content_type)
         raise GenerationFailed, 'サムネール画像が見つかりませんでした．'
       end
 
@@ -80,7 +83,13 @@ module Preview
       nil
     end
 
+    def self.allowed_image_content_type?(content_type)
+      mime_type = content_type.to_s.split(';', 2).first.downcase.strip
+      ALLOWED_IMAGE_CONTENT_TYPES.include?(mime_type)
+    end
+
     private_class_method :fetch_image_or_nil, :fetch_image!,
-                         :niconico_thumbnail_url
+                         :niconico_thumbnail_url,
+                         :allowed_image_content_type?
   end
 end