Enhance image source inference and add tests for hostname validation

- Introduced a helper function to check if a hostname matches a given domain, improving the clarity of the `infer_source_from_url` function.
- Updated the image source inference logic to utilize the new helper function for better maintainability.
- Added a test case to ensure that spoofed hostnames do not match valid image sources, enhancing security and robustness of the inference logic.
- Updated Docker Compose configuration to ensure the correct image is used for the backend service.

Author: seanmorley15

backend/server/adventures/services/images/metadata.py

@@ -28,11 +28,19 @@ class ImageSource:
     IMMICH = ContentImage.Source.IMMICH
 
 
+def _hostname_matches_domain(hostname: str, domain: str) -> bool:
+    return hostname == domain or hostname.endswith(f'.{domain}')
+
+
 def infer_source_from_url(url: str) -> str:
     hostname = (urlparse(url).hostname or '').lower()
-    if 'googleapis.com' in hostname or 'googleusercontent.com' in hostname:
+    if _hostname_matches_domain(hostname, 'googleapis.com') or _hostname_matches_domain(
+        hostname, 'googleusercontent.com'
+    ):
         return ImageSource.GOOGLE
-    if 'wikimedia.org' in hostname or 'wikipedia.org' in hostname:
+    if _hostname_matches_domain(hostname, 'wikimedia.org') or _hostname_matches_domain(
+        hostname, 'wikipedia.org'
+    ):
         return ImageSource.WIKIPEDIA
     return ImageSource.URL
 

backend/server/adventures/tests/test_image_metadata.py

@@ -36,6 +36,17 @@ def test_generic_url(self):
             ImageSource.URL,
         )
 
+    def test_spoofed_hostnames_are_not_matched(self):
+        spoofed_urls = [
+            'https://evil.googleapis.com.attacker.com/photo.jpg',
+            'https://notgoogleusercontent.com/photo.jpg',
+            'https://evil.wikimedia.org.attacker.com/photo.jpg',
+            'https://notwikipedia.org/photo.jpg',
+        ]
+        for url in spoofed_urls:
+            with self.subTest(url=url):
+                self.assertEqual(infer_source_from_url(url), ImageSource.URL)
+
 
 class ImageMetadataResolutionTests(TestCase):
     def test_explicit_source_overrides_url_inference(self):

docker/docker-compose.advanced.yml

@@ -49,7 +49,7 @@ services:
     #   context: ..
     #   dockerfile: docker/Dockerfile
     #   target: backend
-    # image: ghcr.io/seanmorley15/adventurelog-backend:latest
+    image: ghcr.io/seanmorley15/adventurelog-backend:latest
     container_name: adventurelog-backend
     restart: unless-stopped
     env_file: ../.env.advanced