Date: Mon, 9 May 2016 15:03:40 -0500 (CDT) From: Bob Friesenhahn <bfriesen@...ple.dallas.tx.us> To: oss-security@...ts.openwall.com Subject: Re: GraphicsMagick Response To "ImageTragick" On Mon, 9 May 2016, Simon McVittie wrote: > > Great. Is there an API that can be used to say "load this arbitrary file, > but only if it is in a format that is considered entirely safe"? In GraphicsMagick, defining the environment variable MAGICK_CODER_STABILITY=PRIMARY before running the will block out quite a lot of functionality (including SVG/MVG/MSL) but nothing can be considered entirely safe. > I think the reason people are surprised and concerned to read about the > MVG and MSL scripting languages is that they enter *Magick through the > same APIs that open "safe" image files, blurring the boundary between > "open a file" and "execute a script". If the entry point into executing > MVG/MSL scripts was named more like ExecuteScript(), as opposed to > ReadImage(), then I don't think anyone would object to MVG and MSL > files having arbitrary code execution capabilities. It is likely that the *Magick name was coined from the header of XPM files which playfully use the word "magick" as part of the header that programs would use for header magic testing. This sets the stage for the automatic things that the software is doing. In GraphicsMagick, the automatic scary stuff is all done within one function so it is reasonable to develop a less magical mode which is less likely to dispatch to a file reader for an archaic file format which stopped being used in 1993. Bob -- Bob Friesenhahn bfriesen@...ple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/ GraphicsMagick Maintainer, http://www.GraphicsMagick.org/
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ