Skip to content

Fix favicon fetching to check all icon links instead of just the first one#6880

Merged
dani-garcia merged 4 commits intodani-garcia:mainfrom
Shocker:fix-all-icons
Apr 29, 2026
Merged

Fix favicon fetching to check all icon links instead of just the first one#6880
dani-garcia merged 4 commits intodani-garcia:mainfrom
Shocker:fix-all-icons

Conversation

@Shocker
Copy link
Copy Markdown
Contributor

@Shocker Shocker commented Feb 27, 2026 •
edited
Loading

Fix logic in download_icon(), got broken (most likely accidentally) in 27dc67f#diff-c0f730ed83eb02623c5c9bde35b0366115b8961fb596c27f98613140cba6d2a7L714 which caused the downloader to stop after first error

Also don't limit max checked icons to 5, allow all icons in the list

@Shocker Shocker mentioned this pull request Feb 27, 2026
Closed
@BlackDex
Copy link
Copy Markdown
Collaborator

BlackDex commented Feb 27, 2026

The reason we only select the first 5 items is because we do not want to try and download every icon a site has listed.
It could be 1 or 20, and calling a site 20 times might also trigger a block/ban even.

The 5 items from the list are already sorted in a most preferred item is at the top of the list.

Are there specific sites on which you experience issues?
Since, i have run a local script which compares icons between Vaultwarden, Bitwarden, Google and DuckDuckGo.
And there are just a few which do not work currently, but also a lot which Vaultwarden is able to fetch an icon where Bitwarden, Google or DuckDuckGo (Either one or more) is not.

@Shocker
Copy link
Copy Markdown
Contributor Author

Shocker commented Feb 27, 2026

Regarding the 5 limit: I don't have any specific site with issues. To be honest it was just a weird seemingly undocumented line in the code which didn't make sense to have an arbitrary limit of 5.

What about the main issue being fixed with the PR?

@BlackDex
Copy link
Copy Markdown
Collaborator

BlackDex commented Feb 27, 2026

Which main issue do you refer to?
Is it that if one item fails it stop and aborts?

@Shocker
Copy link
Copy Markdown
Contributor Author

Shocker commented Feb 27, 2026

Which main issue do you refer to? Is it that if one item fails it stop and aborts?

Yes.

@Shocker Shocker mentioned this pull request Feb 27, 2026
Open
BlackDex
BlackDex requested changes Apr 5, 2026
View reviewed changes
Comment thread src/api/icons.rs Outdated
@Shocker Shocker requested a review from BlackDex April 7, 2026 16:20
BlackDex
BlackDex approved these changes Apr 18, 2026
View reviewed changes
Copy link
Copy Markdown
Collaborator

@BlackDex BlackDex left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems to work ok. Thanks!

@dani-garcia dani-garcia merged commit 8c3c969 into dani-garcia:main Apr 29, 2026
9 checks passed
@CameronMunroe CameronMunroe mentioned this pull request May 3, 2026
Merged
pieska pushed a commit to pieska/vaultwarden that referenced this pull request May 3, 2026
@Shocker @pieska
Fix favicon fetching to check all icon links instead of just the firs…
6bac60e 
…t one (dani-garcia#6880)

* Fix favicon fetching to check all icon links instead of just the first one

* revert max icons limit removal

* optimize code

* code formatting
dadezzz pushed a commit to dadezzz/infra_docker-compose that referenced this pull request May 4, 2026
@dadezzz
chore(deps): update quay.io/vaultwarden/server docker tag to v1.36.0 …
3927f9e 
…(#243)

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [quay.io/vaultwarden/server](https://github.com/dani-garcia/vaultwarden) | minor | `1.35.8` → `1.36.0` |

---

### Release Notes

<details>
<summary>dani-garcia/vaultwarden (quay.io/vaultwarden/server)</summary>

### [`v1.36.0`](https://github.com/dani-garcia/vaultwarden/releases/tag/1.36.0)

[Compare Source](dani-garcia/vaultwarden@1.35.8...1.36.0)

#### Security Fixes

This release contains security fixes for the following advisories. We strongly advice to update as soon as possible.

- SSO Login CSRF
  [GHSA-pfp2-jhgq-6hg5](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-pfp2-jhgq-6hg5)
  [GHSA-w6h6-8r66-hcv7](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-w6h6-8r66-hcv7)
- User/Organization Enumeration
  [GHSA-hxqh-ff5p-wfr3](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-hxqh-ff5p-wfr3)
- SSO existing-user binding
  [GHSA-j4j8-gpvj-7fqr](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-j4j8-gpvj-7fqr)
  [GHSA-6x5c-84vm-5j56](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-6x5c-84vm-5j56)
- SSRF via Icon Endpoint
  [GHSA-72vh-x5jq-m82g](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-72vh-x5jq-m82g)
- Some crate's updated and other minor security enhancements

These are private for now, pending CVE assignment.

#### Notes

- Archiving of items is available
  <https://bitwarden.com/blog/keep-your-vault-tidy-with-item-archiving/>
  <https://bitwarden.com/nl-nl/help/managing-items/#archive>
- Web Vault updated to v2026.4.1

#### What's Changed

- SSO fallback to UserInfo preferred\_username by [@&#8203;Timshel](https://github.com/Timshel) in [#&#8203;7128](dani-garcia/vaultwarden#7128)
- Dummy identifier need to pass for a guid by [@&#8203;Timshel](https://github.com/Timshel) in [#&#8203;7154](dani-garcia/vaultwarden#7154)
- add new /identity/accounts/prelogin/password by [@&#8203;stefan0xC](https://github.com/stefan0xC) in [#&#8203;7156](dani-garcia/vaultwarden#7156)
- Add DuckDuckGo browser device type by [@&#8203;dfunkt](https://github.com/dfunkt) in [#&#8203;7147](dani-garcia/vaultwarden#7147)
- Apply `duration_suboptimal_units` lint findings by [@&#8203;dfunkt](https://github.com/dfunkt) in [#&#8203;7144](dani-garcia/vaultwarden#7144)
- Apply `ref_option` lint findings by [@&#8203;dfunkt](https://github.com/dfunkt) in [#&#8203;7143](dani-garcia/vaultwarden#7143)
- Fix hardcoded sso identifier by [@&#8203;Timshel](https://github.com/Timshel) in [#&#8203;7157](dani-garcia/vaultwarden#7157)
- Update crates and fix a nightly lint by [@&#8203;BlackDex](https://github.com/BlackDex) in [#&#8203;7161](dani-garcia/vaultwarden#7161)
- Fix Host/IP resolving by [@&#8203;BlackDex](https://github.com/BlackDex) in [#&#8203;7162](dani-garcia/vaultwarden#7162)
- Several SSO Fixes by [@&#8203;BlackDex](https://github.com/BlackDex) in [#&#8203;7163](dani-garcia/vaultwarden#7163)
- Add support for archiving items by [@&#8203;matt-aaron](https://github.com/matt-aaron) in [#&#8203;6916](dani-garcia/vaultwarden#6916)
- Fix favicon fetching to check all icon links instead of just the first one by [@&#8203;Shocker](https://github.com/Shocker) in [#&#8203;6880](dani-garcia/vaultwarden#6880)
- Fix merge conflict by [@&#8203;dani-garcia](https://github.com/dani-garcia) in [#&#8203;7164](dani-garcia/vaultwarden#7164)
- Replace organization\_uuid unwrap with proper error handling by [@&#8203;xjohnyknox](https://github.com/xjohnyknox) in [#&#8203;6936](dani-garcia/vaultwarden#6936)
- fix: return Err instead of panic on unknown cipher atype in to\_json() by [@&#8203;mango766](https://github.com/mango766) in [#&#8203;7068](dani-garcia/vaultwarden#7068)
- Allow SQLite to be linked against dynamically by [@&#8203;ISSOtm](https://github.com/ISSOtm) in [#&#8203;7057](dani-garcia/vaultwarden#7057)
- Update crates and web-vault by [@&#8203;BlackDex](https://github.com/BlackDex) in [#&#8203;7171](dani-garcia/vaultwarden#7171)
- Update hickory by [@&#8203;BlackDex](https://github.com/BlackDex) in [#&#8203;7175](dani-garcia/vaultwarden#7175)

#### New Contributors

- [@&#8203;matt-aaron](https://github.com/matt-aaron) made their first contribution in [#&#8203;6916](dani-garcia/vaultwarden#6916)
- [@&#8203;Shocker](https://github.com/Shocker) made their first contribution in [#&#8203;6880](dani-garcia/vaultwarden#6880)
- [@&#8203;xjohnyknox](https://github.com/xjohnyknox) made their first contribution in [#&#8203;6936](dani-garcia/vaultwarden#6936)
- [@&#8203;mango766](https://github.com/mango766) made their first contribution in [#&#8203;7068](dani-garcia/vaultwarden#7068)
- [@&#8203;ISSOtm](https://github.com/ISSOtm) made their first contribution in [#&#8203;7057](dani-garcia/vaultwarden#7057)

**Full Changelog**: <dani-garcia/vaultwarden@1.35.8...1.36.0>

You can discuss this release here <dani-garcia/vaultwarden#7177>

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNiIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS42IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
birme pushed a commit to eyevinn-osaas/vaultwarden that referenced this pull request May 5, 2026
@Shocker
Fix favicon fetching to check all icon links instead of just the firs…
a5c211a 
…t one (dani-garcia#6880)

* Fix favicon fetching to check all icon links instead of just the first one

* revert max icons limit removal

* optimize code

* code formatting
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@BlackDex BlackDex BlackDex approved these changes

@dani-garcia dani-garcia dani-garcia approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@Shocker @BlackDex @dani-garcia