mirrors/synapse
1
0
Fork 0
mirror of https://github.com/element-hq/synapse.git synced 2024-12-14 11:57:44 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Restrict which image formats we will decode in order to generate thumbnails

Browse source
This commit is contained in:
Olivier 'reivilibre 2024-11-22 15:30:29 +00:00 committed by Quentin Gliech
parent 4b7154c585
commit b64a4e5fbb
No known key found for this signature in database
GPG key ID: 22D62B84552719FC
1 changed files with 6 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
synapse/media/thumbnailer.py
View file

@ -67,6 +67,11 @@ class ThumbnailError(Exception):
class Thumbnailer: class Thumbnailer:
FORMATS = {"image/jpeg": "JPEG", "image/png": "PNG"} FORMATS = {"image/jpeg": "JPEG", "image/png": "PNG"}
# Which image formats we allow Pillow to open.
# This should intentionally be kept restrictive, because the decoder of any
# format in this list becomes part of our trusted computing base.
PILLOW_FORMATS = ("jpeg", "png", "webp", "gif")
@staticmethod @staticmethod
def set_limits(max_image_pixels: int) -> None: def set_limits(max_image_pixels: int) -> None:
Image.MAX_IMAGE_PIXELS = max_image_pixels Image.MAX_IMAGE_PIXELS = max_image_pixels
@ -76,7 +81,7 @@ class Thumbnailer:
self._closed = False self._closed = False
try: try:
self.image = Image.open(input_path) self.image = Image.open(input_path, formats=self.PILLOW_FORMATS)
except OSError as e: except OSError as e:
# If an error occurs opening the image, a thumbnail won't be able to # If an error occurs opening the image, a thumbnail won't be able to
# be generated. # be generated.