dvIsLocalImagePath function

bool dvIsLocalImagePath(String src)

Whether src is an image path inside the site: relative, with no . or .. segment, no empty segment, nothing that a filesystem or a URL parser could read as a drive, a scheme or an escape, and an image's extension.

Deliberately stricter than it needs to be for any real asset name. A % is refused because the query has already been decoded once, and a second decoding somewhere below is how %2e%2e becomes ...

Implementation

bool dvIsLocalImagePath(String src) {
  if (src.isEmpty || src.length > 2048) return false;
  if (src.startsWith('/')) return false;
  for (final String banned in const <String>['\\', ':', '', '?', '#', '%']) {
    if (src.contains(banned)) return false;
  }
  final List<String> segments = src.split('/');
  for (final String segment in segments) {
    if (segment.isEmpty || segment == '.' || segment == '..') return false;
  }
  final String name = segments.last;
  final int dot = name.lastIndexOf('.');
  if (dot <= 0) return false;
  return dvRasterImageExtensions.contains(name.substring(dot + 1).toLowerCase());
}