security: validate OIDC avatar URLs and only store real images - #1295

Depends on #1291, for the URL validator. This branch contains its commits. The new commits are the last two.

Problem

On login, the picture URL supplied by the identity provider is fetched by the server, with redirects followed, and stored as the user's avatar with a content type guessed from the URL. Many identity providers let users set that URL themselves. That gives server-side request forgery, with the response readable afterwards through the avatar endpoint.

Changes

• URL checks: the URL and every redirect hop are checked by the shared OutboundUrlValidator, and the download is capped at 5 MB.
• Image-only storage: the avatar is only stored if its bytes are a PNG, JPEG, GIF or WebP image, with the detected type.

Tests

CustomOidcUserServiceTest: the avatar URLs in these tests now use a private-network address instead of localhost, because loopback targets are rejected.

Security fix series (from a review of 5.6.0; most PRs are independent, dependencies are noted in each PR):

• security: per-install remember-me key, SameSite cookies, API tokens limited to /api, no OIDC re-linking #1284 security: per-install remember-me key, SameSite cookies, API tokens limited to /api, no OIDC re-linking
• security: prevent role self-escalation via user settings #1285 security: prevent role self-escalation via user settings
• security: setup flow only for local admins without a password #1286 security: setup flow only for local admins without a password
• security: access checks for the location, visit, trip and H3 cell APIs #1287 security: access checks for the location, visit, trip and H3 cell APIs
• security: scope trip/visit metadata and transport modes to the owner; reject open redirects #1288 security: scope trip/visit metadata and transport modes to the owner; reject open redirects (builds on security: prevent role self-escalation via user settings #1285)
• security: owner checks for API tokens, magic-link deletion, sharing colours and the job queue #1289 security: owner checks for API tokens, magic-link deletion, sharing colours and the job queue (builds on security: prevent role self-escalation via user settings #1285)
• security: memory ownership, magic-link scope, storage confinement and image-only uploads #1290 security: memory ownership, magic-link scope, storage confinement and image-only uploads
• security: outbound URL validation (SSRF) and locked-down map styles #1291 security: outbound URL validation (SSRF) and locked-down map styles
• security: harden the Immich photo proxy #1292 security: harden the Immich photo proxy (builds on security: outbound URL validation (SSRF) and locked-down map styles #1291)
• security: federation avatars/subscriptions, OwnTracks Recorder and MQTT targets #1293 security: federation avatars/subscriptions, OwnTracks Recorder and MQTT targets (builds on security: outbound URL validation (SSRF) and locked-down map styles #1291)
• security: geocoding services are admin-only, API keys are never rendered #1294 security: geocoding services are admin-only, API keys are never rendered (builds on security: outbound URL validation (SSRF) and locked-down map styles #1291)
• security: validate OIDC avatar URLs and only store real images #1295 security: validate OIDC avatar URLs and only store real images (builds on security: outbound URL validation (SSRF) and locked-down map styles #1291)
• security: escape user-controlled names in map popups #1296 security: escape user-controlled names in map popups
• security: throttle password guessing; trust X-Forwarded-* only from internal proxies #1297 security: throttle password guessing; trust X-Forwarded-* only from internal proxies (builds on security: per-install remember-me key, SameSite cookies, API tokens limited to /api, no OIDC re-linking #1284)
• security: deny-by-default routes for magic links; bind memory links to their memory #1283 security: deny-by-default routes for magic links; bind memory links to their memory (builds on security: per-install remember-me key, SameSite cookies, API tokens limited to /api, no OIDC re-linking #1284, security: access checks for the location, visit, trip and H3 cell APIs #1287, security: memory ownership, magic-link scope, storage confinement and image-only uploads #1290)

GitHub's stacked pull requests are not available for contributions from forks, so dependent PRs include their prerequisite commits and name the new ones. Happy to rebase, split or merge these differently if that is easier to review.

🤖 Generated with Claude Code