Policy file updates and broken scripts..

Questions and postings pertaining to the usage of ImageMagick regardless of the interface. This includes the command-line utilities, as well as the C and C++ APIs. Usage questions are like "How do I use ImageMagick to create drop shadows?".
Post Reply
dognose
Posts: 265
Joined: 2005-03-08T22:16:37-07:00

Policy file updates and broken scripts..

Post by dognose »

Hi,
I'm trying to come to terms with the new policy file updates,
and how to fix my scripts that have been broken by it.
specifically <policy domain="path" rights="none" pattern="@*" />
I'm thinking the LABEL and TEXT are also a concern.

An example of how I use it would be -annotate @text.txt

So, yes, I'm using IM on a server with user inputs, and security is important for me.
However, instead of a blanket ban on these features, I'd like to properly sanitize the
inputs that would cause security problems. Is this possible?

Or, come up with alternative functions that could replace what is broken.

Can anyone point me to the troubles
User avatar
fmw42
Posts: 25562
Joined: 2007-07-02T17:14:51-07:00
Authentication code: 1152
Location: Sunnyvale, California, USA

Re: Policy file updates and broken scripts..

Post by fmw42 »

One possible way:

Instead of:

Code: Select all

convert -size 200x200 xc:white -font arial -pointsize 18 -gravity center -annotate +0+0 '@test.txt' tmp1.png
do:

Code: Select all

str=`cat test.txt`
[ Then parse the str variable for things like magick describes below, if you want to sanitize it ]
convert -size 200x200 xc:white -font arial -pointsize 18 -gravity center -annotate +0+0 "$str" tmp2.png
dognose
Posts: 265
Joined: 2005-03-08T22:16:37-07:00

Re: Policy file updates and broken scripts..

Post by dognose »

I was having trouble with special characters in the command line.
My bigger question is how is including a text file for annotation a security problem?
Can commands be embedded in that?
User avatar
magick
Site Admin
Posts: 11064
Joined: 2003-05-31T11:32:55-07:00

Re: Policy file updates and broken scripts..

Post by magick »

Think label:@/etc/passwd. Eliminate the indirect read and it helps avoid this vulnerability.
Post Reply