From df63ad1799929a55626819d6fba6f6bf9585282e Mon Sep 17 00:00:00 2001
From: Cory Dransfeldt <hi@coryd.dev>
Date: Sat, 10 May 2025 17:37:14 -0700
Subject: [PATCH] fix(oembed.php + og-image.php): route oembed images through
 proxy

---
 api/oembed.php           |  4 ++--
 api/og-image.php         | 20 +++++++-------------
 package-lock.json        |  4 ++--
 package.json             |  2 +-
 src/meta/htaccess.liquid |  5 +++++
 5 files changed, 17 insertions(+), 18 deletions(-)

diff --git a/api/oembed.php b/api/oembed.php
index 5cea468..a1bf6be 100644
--- a/api/oembed.php
+++ b/api/oembed.php
@@ -29,7 +29,7 @@ class OembedHandler extends BaseHandler
         'author_name' => $globals['author'],
         'provider_name' => $globals['site_name'],
         'provider_url' => $globals['url'],
-        'thumbnail_url' => $globals['url'] . $item['image_url'],
+        'thumbnail_url' => $globals['url'] . '/og/w800' . $item['image_url'],
         'html' => '<a href="' . htmlspecialchars($item['url']) . '">' . htmlspecialchars($item['title']) . '</a>',
       ]);
     }
@@ -44,7 +44,7 @@ class OembedHandler extends BaseHandler
         'author_name' => $globals['author'],
         'provider_name' => $globals['site_name'],
         'provider_url' => $globals['url'],
-        'thumbnail_url' => $globals['url'] . $globals['avatar'],
+        'thumbnail_url' => $globals['url'] . '/og/w800' . $globals['avatar'],
         'html' => '<a href="' . htmlspecialchars($relativePath) . '">' . htmlspecialchars($title) . '</a>',
       ]);
     }
diff --git a/api/og-image.php b/api/og-image.php
index 64eb118..97970db 100644
--- a/api/og-image.php
+++ b/api/og-image.php
@@ -1,10 +1,12 @@
 <?php
+
   $id = $_GET['id'] ?? null;
   $class = $_GET['class'] ?? null;
   $extension = $_GET['extension'] ?? 'png';
   $isValidId = is_string($id) && preg_match('/^[a-f0-9\-]{36}$/', $id);
+  $isValidClass = is_string($class) && preg_match('/^w\d{2,4}$/', $class);
 
-  if (!$isValidId || !$class) {
+  if (!$isValidId || !$isValidClass) {
     header("Location: /404", true, 302);
     exit;
   }
@@ -22,19 +24,11 @@
 
   curl_close($ch);
 
-  error_log("CDN response code: $httpCode, Content-Type: $contentType");
-
-  if ($httpCode !== 200 || $image === false) {
-    error_log("Failed to fetch image: $cdnUrl");
+  if ($httpCode !== 200 || $image === false || strpos($contentType, 'image/') !== 0) {
+    error_log("Failed to fetch image: $cdnUrl ($httpCode - $contentType)");
     header("Location: /404", true, 302);
     exit;
   }
 
-  if (strpos($contentType, 'image/') === 0) {
-    header("Content-Type: $contentType");
-    echo $image;
-  } else {
-    error_log("Invalid content type: $contentType");
-    header("Location: /404", true, 302);
-    exit;
-  }
+  header("Content-Type: $contentType");
+  echo $image;
diff --git a/package-lock.json b/package-lock.json
index 10c4833..43285a0 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "coryd.dev",
-  "version": "4.0.0",
+  "version": "4.0.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "coryd.dev",
-      "version": "4.0.0",
+      "version": "4.0.1",
       "license": "MIT",
       "dependencies": {
         "html-minifier-terser": "7.2.0",
diff --git a/package.json b/package.json
index b944893..8e2aec4 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "coryd.dev",
-  "version": "4.0.0",
+  "version": "4.0.1",
   "description": "The source for my personal site. Built using 11ty (and other tools).",
   "type": "module",
   "engines": {
diff --git a/src/meta/htaccess.liquid b/src/meta/htaccess.liquid
index ccc620f..dc9188b 100644
--- a/src/meta/htaccess.liquid
+++ b/src/meta/htaccess.liquid
@@ -48,6 +48,11 @@ RewriteRule ^music/genres/([^/]+)/?$ music/genres/index.php [L]
 RewriteRule ^tags/([^/]+)(?:/([0-9]+))?/?$ tags/index.php [L]
 
 ## open graph assets
+
+# w/out version
+RewriteRule ^og/([a-z0-9\-]+)/([a-f0-9\-]+)\.([a-z0-9]+)$ /api/og-image.php?id=$2&class=$1&extension=$3 [L]
+
+# w/version
 RewriteRule ^og/([a-z0-9\-]+)/([\d\.]+)/([a-f0-9\-]+)\.([a-z0-9]+)$ /api/og-image.php?id=$3&class=$1&v=$2&extension=$4 [L]
 
 ## oembed