Proxy package icons that are not served over SSL

[maartenba]

For example on https://www.nuget.org/packages/Microsoft.Data.OData/5.0.0.50403 there is a JS security error SEC7111: HTTPS security is compromised by http://static.tumblr.com/hgchgxz/9ualgdf98/icon.png

[maartenba]

Building a port of https://github.com/atmos/camo/blob/master/README.md

[maartenba]

Port completed - https://github.com/maartenba/CamoDotNet
We can use this if/when we decide to implement this improvement.

[304NotModified]

+1

[maartenba]

If still needed, CamoDotNet is still out there :-)

[NickCraver]

Wouldn't #1074 cover this? If images are brought in and hosed by NuGet (I'm not sure why #14 was closed?) 3 issues could be solved at once:

• Mixed Content (this one, Proxy package icons that are not served over SSL #2613)
• HTTP/HTTPS Package Icons (Package icons should only be HTTP/HTTPS #2899)
• Allow Image uploading (Allow uploading 128 x 128 custom icon for package  #1074)

I'd propose that NuGet simply grabs and re-hosts the image when a package is uploaded (this wouldn't be hard to backfill as well). This of course only happens if the URL is valid. Having an on-site way for the owner to replace the image isn't crazy either.

This also prevents leaking search data to other domains, which is currently the case for any https:// icons. The referer header is being sent to those packages, allowing them to see which searches hit their package. I'm not sure if that's a concern or not, but seeing all the IPs, etc. of users hitting NuGet.org I wouldn't think is intentional.

Thoughts?

[skofman1]

We started work on having icons inside the NuGet package: https://github.com/NuGet/Home/wiki/Packaging-Icon-within-the-nupkg
Since icon url will be deprecated, insecure icon URLs will not be a problem in the future. As part of the work we will also secure icons for existing packages. More details will be shared as we work on the design.
//cc: @agr , @zivkan