mirror of
https://github.com/discourse/discourse.git
synced 2026-08-06 07:23:30 +08:00
ca5a7e0616
Add a default-deny ImageMagick security policy at `config/imagemagick/policy.xml`, loaded via `MAGICK_CONFIGURE_PATH` which is set in `config/initializers/003-imagemagick.rb`. Child processes inherit the env var, so every `identify`/`magick`/`convert` we shell out to is covered, including from plugins. Discourse previously shipped an imagemagick policy in production (see `discourse/discourse_docker` repository). This change brings the policy into the core repository to make it more visible, easier to manage, and applicable for development environments. Resource limitations remain the same. The main change is to move the allowed coders to an allowlist instead of a denylist. This ensures consistent safety, regardless of the set of modules available on the system. `Upload#fix_dimensions!` is updated to explicitly set the `MSVG:` decoder. This is the decoder which Imagemagick was selecting previously for `-ping` calls. But now, since the `svg` coder isn't in our allowlist, we have to specify msvg explicitly. The pdf-to-image logic in discourse-ai (behind an experimental, hidden, and default-disabled setting) is removed, since it depended on processing pdfs via Imagemagick/ghostscript. The spec for svg rasterization via OptimizedImage is also removed. This was not used in any application code. --- https://github.com/discourse/discourse/security/advisories/GHSA-7wq5-jgww-5rw3
22 lines
774 B
Ruby
Vendored
22 lines
774 B
Ruby
Vendored
# frozen_string_literal: true
|
|
|
|
# Guards config/imagemagick/policy.xml. A malformed policy fails open silently
|
|
# (e.g. a stray backtick drops every rule after it), so assert it is parsed and
|
|
# enforced.
|
|
RSpec.describe "ImageMagick security policy" do
|
|
it "loads the coder allowlist" do
|
|
policy = Discourse::Utils.execute_command("magick", "-list", "policy")
|
|
|
|
expect(policy).to match(/Policy: Coder/i)
|
|
expect(policy).to include("MSVG")
|
|
end
|
|
|
|
it "blocks a coder that is not on the allowlist" do
|
|
png = Rails.root.join("spec/fixtures/images/logo.png").to_s
|
|
|
|
expect { Discourse::Utils.execute_command("identify", "TIFF:#{png}") }.to raise_error(
|
|
Discourse::Utils::CommandError,
|
|
/not (allowed|authorized) by the security policy/,
|
|
)
|
|
end
|
|
end
|
