fix(security): proxy external markdown images via Cloudinary #3542

idoshamun · 2026-02-04T10:13:40Z

Summary

Implement server-side image proxy using Cloudinary fetch to prevent user IP exposure when viewing posts with external images in markdown
Add URL validation with SSRF protection (block private IPs, validate protocols)
Use signed Cloudinary URLs to prevent CDN quota abuse
Hook into markdown-it renderer to transform external image URLs at render time

Security measures

Signed URLs: Only the backend can generate valid proxy URLs
SSRF prevention: Block requests to private IP ranges (127.x, 10.x, 192.168.x, 169.254.x, 172.16-31.x)
Protocol validation: Only allow HTTP/HTTPS, block file:// and other dangerous protocols
Allowlist: Skip proxying for already-trusted domains (media.daily.dev, res.cloudinary.com)

Closes ENG-589

Created by Huginn 🐦‍⬛

When users view posts containing external images in markdown, their browsers make direct requests to those external servers, exposing IP addresses and user-agent information. This change implements a server-side image proxy using Cloudinary's fetch capability to cache and serve external images through media.daily.dev. Key features: - Create imageProxy utility with signed Cloudinary fetch URLs - Validate URLs: only HTTP/HTTPS protocols, block private IPs (SSRF prevention) - Skip proxying for already-allowed domains (media.daily.dev, res.cloudinary.com) - Hook into markdown-it's image renderer to transform external image URLs - Block invalid/malicious URLs by setting empty src attribute Security considerations: - Signed URLs prevent CDN quota abuse (only backend can generate valid URLs) - SSRF protection via private IP blocking (127.x, 10.x, 192.168.x, etc.) - Protocol validation prevents file:// and other dangerous protocols - URL length limit prevents abuse Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- Add explicit cloudinary SDK configuration in test beforeEach hooks - Fix test expectations for file:// protocol (markdown-it doesn't render them as images) - Fix test expectations for proxied URLs (original URL is included in fetch URL) - Add documentation comment explaining protocol handling in isExternalImageUrl Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

pulumi · 2026-02-04T10:14:46Z

🍹 The Update (preview) for dailydotdev/api/prod (at eb097ff) was successful.

Resource Changes

    Name                                                       Type                           Operation
+   vpc-native-api-clickhouse-migration-024dab72               kubernetes:batch/v1:Job        create
~   vpc-native-update-tag-recommendations-cron                 kubernetes:batch/v1:CronJob    update
~   vpc-native-generic-referral-reminder-cron                  kubernetes:batch/v1:CronJob    update
~   vpc-native-private-deployment                              kubernetes:apps/v1:Deployment  update
+   vpc-native-api-db-migration-024dab72                       kubernetes:batch/v1:Job        create
~   vpc-native-hourly-notification-cron                        kubernetes:batch/v1:CronJob    update
~   vpc-native-user-posts-analytics-refresh-cron               kubernetes:batch/v1:CronJob    update
~   vpc-native-check-analytics-report-cron                     kubernetes:batch/v1:CronJob    update
~   vpc-native-post-analytics-history-day-clickhouse-cron      kubernetes:batch/v1:CronJob    update
~   vpc-native-clean-zombie-opportunities-cron                 kubernetes:batch/v1:CronJob    update
~   vpc-native-post-analytics-clickhouse-cron                  kubernetes:batch/v1:CronJob    update
~   vpc-native-user-profile-updated-sync-cron                  kubernetes:batch/v1:CronJob    update
-   vpc-native-api-clickhouse-migration-a7439cef               kubernetes:batch/v1:Job        delete
-   vpc-native-api-db-migration-a7439cef                       kubernetes:batch/v1:Job        delete
~   vpc-native-clean-zombie-images-cron                        kubernetes:batch/v1:CronJob    update
~   vpc-native-user-profile-analytics-history-clickhouse-cron  kubernetes:batch/v1:CronJob    update
~   vpc-native-update-trending-cron                            kubernetes:batch/v1:CronJob    update
~   vpc-native-bg-deployment                                   kubernetes:apps/v1:Deployment  update
~   vpc-native-deployment                                      kubernetes:apps/v1:Deployment  update
~   vpc-native-update-source-public-threshold-cron             kubernetes:batch/v1:CronJob    update
~   vpc-native-update-tags-str-cron                            kubernetes:batch/v1:CronJob    update
~   vpc-native-user-profile-analytics-clickhouse-cron          kubernetes:batch/v1:CronJob    update
~   vpc-native-clean-stale-user-transactions-cron              kubernetes:batch/v1:CronJob    update
~   vpc-native-clean-zombie-users-cron                         kubernetes:batch/v1:CronJob    update
~   vpc-native-validate-active-users-cron                      kubernetes:batch/v1:CronJob    update
~   vpc-native-temporal-deployment                             kubernetes:apps/v1:Deployment  update
~   vpc-native-clean-zombie-user-companies-cron                kubernetes:batch/v1:CronJob    update
~   vpc-native-ws-deployment                                   kubernetes:apps/v1:Deployment  update
~   vpc-native-update-highlighted-views-cron                   kubernetes:batch/v1:CronJob    update
~   vpc-native-update-views-cron                               kubernetes:batch/v1:CronJob    update
~   vpc-native-personalized-digest-cron                        kubernetes:batch/v1:CronJob    update
~   vpc-native-expire-super-agent-trial-cron                   kubernetes:batch/v1:CronJob    update
~   vpc-native-personalized-digest-deployment                  kubernetes:apps/v1:Deployment  update
~   vpc-native-clean-gifted-plus-cron                          kubernetes:batch/v1:CronJob    update
~   vpc-native-daily-digest-cron                               kubernetes:batch/v1:CronJob    update
~   vpc-native-update-source-tag-view-cron                     kubernetes:batch/v1:CronJob    update
~   vpc-native-calculate-top-readers-cron                      kubernetes:batch/v1:CronJob    update
~   vpc-native-sync-subscription-with-cio-cron                 kubernetes:batch/v1:CronJob    update
~   vpc-native-update-current-streak-cron                      kubernetes:batch/v1:CronJob    update
~   vpc-native-generate-search-invites-cron                    kubernetes:batch/v1:CronJob    update
... and 1 other changes

idoshamun · 2026-02-04T10:45:21Z

src/common/imageProxy.ts

+  }
+
+  // Only consider http/https URLs as external (relative URLs and other protocols are skipped)
+  if (!url.startsWith('http://') && !url.startsWith('https://')) {


I see we checked for this condition also in validateImageUrl. One of them is redundant

idoshamun · 2026-02-04T10:47:18Z

src/common/imageProxy.ts

+ * @param html The HTML content containing images
+ * @returns The HTML with external image URLs replaced with proxied URLs
+ */
+export function proxyImagesInHtml(html: string): string {


I don't see that we use it anywhere. we can consider removing it

idoshamun · 2026-02-04T10:48:26Z

@claude review my PR comments and address them. Make sure you update the relevant AGENTS.md if needed to avoid making the same mistakes. Verify lint and relevant tests

claude · 2026-02-04T10:48:40Z

Claude finished @idoshamun's task in 2m 54s —— View job

Addressing PR Review Comments ✓

Read and understand the code and review comments
Fix redundant condition check in imageProxy.ts:106
Remove unused code at imageProxy.ts:172
Review and update AGENTS.md if needed
Commit and push changes

Changes Made

Fixed redundant protocol check: Removed the protocol validation from validateImageUrl since isExternalImageUrl already filters out non-http/https URLs before calling it. Added a comment documenting this assumption.
Removed unused function: Deleted proxyImagesInHtml function and all its tests (60+ lines) since it's not used anywhere in the codebase. The markdown-it renderer hooks handle all image proxying.
Updated AGENTS.md: Added a new best practices section on "Avoiding Dead Code and Redundant Validation" to document these lessons learned and prevent similar issues in the future.

Summary

All PR review comments have been addressed. The changes remove ~110 lines of redundant/unused code and add documentation to prevent similar issues. CI will verify lint and tests pass.

--- | Branch: eng-589-bug-user-ip-addresses-exposed-via-remote-images | Latest commit: 89d126e

- Remove redundant protocol check in validateImageUrl (already filtered by isExternalImageUrl) - Remove unused proxyImagesInHtml function and its tests - Update AGENTS.md with best practices for avoiding dead code and redundant validation Co-authored-by: Ido Shamun <idoshamun@users.noreply.github.com>

idoshamun and others added 2 commits February 4, 2026 09:54

idoshamun requested review from a team and capJavert as code owners February 4, 2026 10:13

idoshamun requested review from AmarTrebinjac, omBratteng and rebelchris February 4, 2026 10:13

idoshamun commented Feb 4, 2026

View reviewed changes

github-actions bot and others added 2 commits February 4, 2026 10:51

Delete __tests__/common/imageProxy.ts

eb097ff

idoshamun merged commit 0b51aaa into main Feb 4, 2026
8 of 9 checks passed

idoshamun deleted the eng-589-bug-user-ip-addresses-exposed-via-remote-images branch February 4, 2026 11:05

meyer-pidiache mentioned this pull request Feb 4, 2026

🐛 BUG: User IP Addresses Exposed via Remote Images dailydotdev/daily#1976

Closed

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(security): proxy external markdown images via Cloudinary #3542

fix(security): proxy external markdown images via Cloudinary #3542

idoshamun commented Feb 4, 2026

Uh oh!

pulumi bot commented Feb 4, 2026 •

edited

Loading

Uh oh!

idoshamun Feb 4, 2026

Uh oh!

idoshamun Feb 4, 2026

Uh oh!

idoshamun commented Feb 4, 2026

Uh oh!

claude bot commented Feb 4, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

fix(security): proxy external markdown images via Cloudinary #3542

fix(security): proxy external markdown images via Cloudinary #3542

Conversation

idoshamun commented Feb 4, 2026

Summary

Security measures

Closes ENG-589

Uh oh!

pulumi bot commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Resource Changes

Uh oh!

idoshamun Feb 4, 2026

Choose a reason for hiding this comment

Uh oh!

idoshamun Feb 4, 2026

Choose a reason for hiding this comment

Uh oh!

idoshamun commented Feb 4, 2026

Uh oh!

claude bot commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Addressing PR Review Comments ✓

Changes Made

Summary

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

pulumi bot commented Feb 4, 2026 •

edited

Loading

claude bot commented Feb 4, 2026 •

edited

Loading