From 5558e8990b6f829e84e5fdf92f23bdc1a248bb57 Mon Sep 17 00:00:00 2001
From: Thomas Kaul <4159106+dtslvr@users.noreply.github.com>
Date: Wed, 15 Jul 2026 12:10:41 +0200
Subject: [PATCH] Harden url validation in logo endpoint

---
 apps/api/src/app/logo/logo.service.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/api/src/app/logo/logo.service.ts b/apps/api/src/app/logo/logo.service.ts
index ab8007041e..e01e6cace0 100644
--- a/apps/api/src/app/logo/logo.service.ts
+++ b/apps/api/src/app/logo/logo.service.ts
@@ -47,7 +47,7 @@ export class LogoService {
   private async getBuffer(aUrl: string) {
     const blob = await this.fetchService
       .fetch(
-        `https://t0.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=${encodeURIComponent(aUrl)}&size=64`,
+        `https://t0.gstatic.com/faviconV2?client=SOCIAL&fallback_opts=TYPE,SIZE,URL&size=64&type=FAVICON&url=${encodeURIComponent(aUrl)}`,
         {
           headers: { 'User-Agent': 'request' },
           signal: AbortSignal.timeout(