From 855d6b1a228b8d7a1c48b819557ff089a8627275 Mon Sep 17 00:00:00 2001
From: Thomas Kaul <4159106+dtslvr@users.noreply.github.com>
Date: Tue, 14 Jul 2026 19:06:16 +0200
Subject: [PATCH 1/3] Harden url validation in logo endpoint

---
 apps/api/src/app/logo/get-logo.dto.ts    | 9 +++++++++
 apps/api/src/app/logo/logo.controller.ts | 3 ++-
 apps/api/src/app/logo/logo.service.ts    | 2 +-
 3 files changed, 12 insertions(+), 2 deletions(-)
 create mode 100644 apps/api/src/app/logo/get-logo.dto.ts

diff --git a/apps/api/src/app/logo/get-logo.dto.ts b/apps/api/src/app/logo/get-logo.dto.ts
new file mode 100644
index 000000000..e19753157
--- /dev/null
+++ b/apps/api/src/app/logo/get-logo.dto.ts
@@ -0,0 +1,9 @@
+import { IsUrl } from 'class-validator';
+
+export class GetLogoDto {
+  @IsUrl({
+    protocols: ['http', 'https'],
+    require_protocol: true
+  })
+  url: string;
+}
diff --git a/apps/api/src/app/logo/logo.controller.ts b/apps/api/src/app/logo/logo.controller.ts
index fdbe430c9..47bd1fc75 100644
--- a/apps/api/src/app/logo/logo.controller.ts
+++ b/apps/api/src/app/logo/logo.controller.ts
@@ -12,6 +12,7 @@ import {
 import { DataSource } from '@prisma/client';
 import { Response } from 'express';
 
+import { GetLogoDto } from './get-logo.dto';
 import { LogoService } from './logo.service';
 
 @Controller('logo')
@@ -41,7 +42,7 @@ export class LogoController {
 
   @Get()
   public async getLogoByUrl(
-    @Query('url') url: string,
+    @Query() { url }: GetLogoDto,
     @Res() response: Response
   ) {
     try {
diff --git a/apps/api/src/app/logo/logo.service.ts b/apps/api/src/app/logo/logo.service.ts
index 551d62438..ab8007041 100644
--- a/apps/api/src/app/logo/logo.service.ts
+++ b/apps/api/src/app/logo/logo.service.ts
@@ -47,7 +47,7 @@ export class LogoService {
   private async getBuffer(aUrl: string) {
     const blob = await this.fetchService
       .fetch(
-        `https://t0.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=${aUrl}&size=64`,
+        `https://t0.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=${encodeURIComponent(aUrl)}&size=64`,
         {
           headers: { 'User-Agent': 'request' },
           signal: AbortSignal.timeout(

From 61ea18e21e4b113cb42b4046773e30eb7405072e Mon Sep 17 00:00:00 2001
From: Thomas Kaul <4159106+dtslvr@users.noreply.github.com>
Date: Tue, 14 Jul 2026 19:06:47 +0200
Subject: [PATCH 2/3] Update changelog

---
 CHANGELOG.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 35c87f60f..13e42f976 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## Unreleased
+
+### Changed
+
+- Hardened the validation of the URL in the logo endpoint
+
 ## 3.26.0 - 2026-07-14
 
 ### Added

From 4c7f2e79e05e9c5f885c845dd1888db74f1044ac Mon Sep 17 00:00:00 2001
From: Thomas Kaul <4159106+dtslvr@users.noreply.github.com>
Date: Tue, 14 Jul 2026 19:15:35 +0200
Subject: [PATCH 3/3] Harden url validation in logo endpoint

---
 libs/ui/src/lib/entity-logo/entity-logo-image-source.service.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libs/ui/src/lib/entity-logo/entity-logo-image-source.service.ts b/libs/ui/src/lib/entity-logo/entity-logo-image-source.service.ts
index 9cbea529b..db916a34f 100644
--- a/libs/ui/src/lib/entity-logo/entity-logo-image-source.service.ts
+++ b/libs/ui/src/lib/entity-logo/entity-logo-image-source.service.ts
@@ -15,6 +15,6 @@ export class EntityLogoImageSourceService {
   }
 
   public getLogoUrlByUrl(url: string) {
-    return `../api/v1/logo?url=${url}`;
+    return `../api/v1/logo?url=${encodeURIComponent(url)}`;
   }
 }