mirror of
https://github.com/discourse/discourse.git
synced 2026-08-06 10:47:18 +08:00
a071880169- Update all imagemagick calls to go through a new `::Imagemagick` wrapper, which wraps the command in `Discourse::SafeExec` - Patch image_optim to force its calls through `SafeExec` This provides robust defense-in-depth against vulnerabilities in image processing binaries. Landlock is supported on Linux Kernel 5.13 and above.
39 lines
1.2 KiB
Ruby
Vendored
39 lines
1.2 KiB
Ruby
Vendored
# frozen_string_literal: true
|
|
|
|
require "image_optim/cmd"
|
|
|
|
# Route image_optim's optimizer binaries through the Landlock sandbox, confining
|
|
# them to the file being optimized with no network. Cmd.capture (version/CPU
|
|
# probes, no untrusted input) is intentionally not patched.
|
|
class ImageOptim
|
|
module Cmd
|
|
class << self
|
|
def run(*args)
|
|
options = args.last.is_a?(Hash) ? args.pop : {}
|
|
env = args.first.is_a?(Hash) ? args.shift : {}
|
|
|
|
files = args.select { |arg| arg.is_a?(String) && File.file?(arg) }
|
|
dirs = files.map { |file| File.dirname(file) }.uniq
|
|
|
|
Discourse::SafeExec.capture(
|
|
*args,
|
|
env: {
|
|
**env,
|
|
"MALLOC_ARENA_MAX" => "2",
|
|
},
|
|
unsetenv_others: true,
|
|
read: [*Discourse::SafeExec.default_read_paths, *files],
|
|
write: [*files, *dirs],
|
|
execute: Discourse::SafeExec.default_execute_paths,
|
|
timeout: options[:timeout]&.to_f || ImageMagick::DEFAULT_TIMEOUT,
|
|
rlimits: ImageMagick::RLIMITS,
|
|
seccomp_deny_network: true,
|
|
)
|
|
true
|
|
rescue Discourse::Utils::CommandError
|
|
# non-zero exit means "kept the original", like system(*args) => false
|
|
false
|
|
end
|
|
end
|
|
end
|
|
end
|
