mirror of
https://github.com/discourse/discourse.git
synced 2026-08-06 02:19:55 +08:00
ca5a7e0616
Add a default-deny ImageMagick security policy at `config/imagemagick/policy.xml`, loaded via `MAGICK_CONFIGURE_PATH` which is set in `config/initializers/003-imagemagick.rb`. Child processes inherit the env var, so every `identify`/`magick`/`convert` we shell out to is covered, including from plugins. Discourse previously shipped an imagemagick policy in production (see `discourse/discourse_docker` repository). This change brings the policy into the core repository to make it more visible, easier to manage, and applicable for development environments. Resource limitations remain the same. The main change is to move the allowed coders to an allowlist instead of a denylist. This ensures consistent safety, regardless of the set of modules available on the system. `Upload#fix_dimensions!` is updated to explicitly set the `MSVG:` decoder. This is the decoder which Imagemagick was selecting previously for `-ping` calls. But now, since the `svg` coder isn't in our allowlist, we have to specify msvg explicitly. The pdf-to-image logic in discourse-ai (behind an experimental, hidden, and default-disabled setting) is removed, since it depended on processing pdfs via Imagemagick/ghostscript. The spec for svg rasterization via OptimizedImage is also removed. This was not used in any application code. --- https://github.com/discourse/discourse/security/advisories/GHSA-7wq5-jgww-5rw3
15 lines
741 B
Ruby
Vendored
15 lines
741 B
Ruby
Vendored
# frozen_string_literal: true
|
|
|
|
# Point ImageMagick at Discourse's security policy (config/imagemagick/policy.xml).
|
|
# Child processes inherit this env var, so it covers every identify/magick/convert
|
|
# call. Refuse to boot if it points somewhere else, since overriding it would
|
|
# bypass the policy. Our own value is allowed (the app may boot more than once in
|
|
# a process tree, e.g. parallel test workers).
|
|
path = Rails.root.join("config/imagemagick").to_s
|
|
|
|
if ENV["MAGICK_CONFIGURE_PATH"] && ENV["MAGICK_CONFIGURE_PATH"] != path
|
|
raise "MAGICK_CONFIGURE_PATH must not be set externally; Discourse manages it " \
|
|
"to enforce its ImageMagick security policy (config/imagemagick/policy.xml)."
|
|
end
|
|
|
|
ENV["MAGICK_CONFIGURE_PATH"] = path
|
