Function resolveImageAnnotation

examples/pdf-server/server.ts:1842–1906

* Resolve an image annotation: fetch imageUrl → imageData if needed, * auto-detect dimensions, and set defaults for x/y. * * SECURITY: imageUrl is model-controlled. It must pass the same * validateUrl() gate as display_pdf/save_pdf — otherwise the model * can request `{image

(
      ann: Record<string, any>,
    )

     * tool result carries the error; silent skip hides the attack attempt.
     */
    async function resolveImageAnnotation(
      ann: Record<string, any>,
    ): Promise<void> {
      // Fetch image data from URL if no imageData provided
      if (!ann.imageData && ann.imageUrl) {
        const url = String(ann.imageUrl);
        // Same gate as every other local/remote read in this server.
        // Local: must be in allowedLocalFiles or under allowedLocalDirs.
        // Remote: must be https://.
        const check = validateUrl(url);
        if (!check.valid) {
          throw new Error(
            `imageUrl rejected by validateUrl: ${check.error ?? url}`,
          );
        }
        let imgBytes: Uint8Array;
        if (url.startsWith("https://")) {
          const resp = await fetch(url);
          if (!resp.ok) throw new Error(`HTTP ${resp.status} for ${url}`);
          imgBytes = new Uint8Array(await resp.arrayBuffer());
        } else {
          // validateUrl already confirmed this path is under an allowed root.
          const filePath = isFileUrl(url)
            ? fileUrlToPath(url)
            : decodeURIComponent(url);
          imgBytes = await fs.promises.readFile(path.resolve(filePath));
        }
        ann.imageData = Buffer.from(imgBytes).toString("base64");
      }

      // Auto-detect mimeType from magic bytes if not set
      if (ann.imageData && !ann.mimeType) {
        const bytes = Buffer.from(ann.imageData, "base64");
        if (
          bytes[0] === 0x89 &&
          bytes[1] === 0x50 &&
          bytes[2] === 0x4e &&
          bytes[3] === 0x47
        ) {
          ann.mimeType = "image/png";
        } else {
          ann.mimeType = "image/jpeg";
        }
      }

      // Auto-detect dimensions from image if not specified
      if (ann.imageData && (ann.width == null || ann.height == null)) {
        const dims = detectImageDimensions(
          Buffer.from(ann.imageData, "base64"),
        );
        if (dims) {
          const maxWidth = 200; // default max width in PDF points
          const aspectRatio = dims.height / dims.width;
          ann.width = ann.width ?? Math.min(dims.width, maxWidth);
          ann.height = ann.height ?? ann.width * aspectRatio;
        } else {
          ann.width = ann.width ?? 200;
          ann.height = ann.height ?? 200;