Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

webp_transform: ImageMagick runs without a security policy

オープン
  • 何か問題がありますか？
#13,774 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 2 日以内に返信

まだ誰も着手していません。

評価

難易度
5/5
見積もり時間
1週間以上
初心者へのやさしさ
35/100
issue の種類
機能追加
明瞭さ
おおむね明確
活発さ
活発
技術スタック
cpp
領域
security

調査の方向性

Start at the webp_transform initialization path and inspect has_signature_for() plus the existing ImageMagick setup. Trace SetMagickSecurityPolicy() behavior and host-policy interactions, including process-wide effects on other ImageMagick users. Done means the plugin enforces the stated coder, delegate, filter, path, frame, and limit policy, logs incompatible host settings, and disables itself when installation or required formats fail.

索引モデルが issue の本文から書いたものです。

説明

Plugins

Problem

webp_transform passes origin response bodies to ImageMagick, which chooses a coder by sniffing the bytes. The plugin never restricts ImageMagick, so the effective policy is whatever policy.xml the host has. If none is found, ImageMagick's built-in default allows everything.

Today has_signature_for() only lets through bodies that start with a JPEG, PNG or WebP signature, so this is a defense-in-depth gap rather than a known hole. But nothing inside ImageMagick enforces that restriction. If any path ever reached it, ImageMagick would still parse SVG, MSL, PostScript (via Ghostscript), TIFF, MNG and others. MNG and JNG are part of the same module as PNG.

Related issues:

  • Animated WebP: ImageMagick decodes every frame before Magick++ keeps the first, so the work grows with the frame count up to the resource limits.
  • Host limits: a host policy.xml can lower the plugin's decode limits. When it does, conversions quietly turn into pass-throughs and nothing is logged.
  • The websafe policy doesn't fit. ImageMagick's own websafe policy isn't a drop-in fix:
    • With the plugin's disk(0), its 8000-pixel area limit fails nearly every image.
    • Its dynamic-throttle setting sleeps on event threads.
    • It still allows GIF, BMP, TIFF, MNG and JNG.
    • It's a build-time option only from ImageMagick 7.1.1-16.

Proposal

At init, install a policy specific to the plugin with SetMagickSecurityPolicy(), which is available since IM6 6.9.10 and IM7 7.0.10:

  • Allow only the coders and modules the plugin uses: read JPEG, PNG and WebP; write JPEG and WebP.
  • Deny delegates (external programs), filters and file paths.
  • Limit decodes to single-frame images.
  • Never re-allow anything the host policy denies. If the host denies a format the plugin needs, log an error and disable the plugin.
  • Check the result after installing the policy, and disable the plugin if it didn't take effect.
  • At startup, warn about host settings that quietly prevent conversions: lowered limits, a time limit, dynamic throttling, or a small max-memory-request.

The policy applies to the whole process, so it would also restrict other ImageMagick users in the same traffic_server, such as the experimental magick plugin. That should be documented.

主要言語
C++
スター
2k
フォーク
881
平均マージ
3日 11時間
マージ済み PR（30日）
81

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

apache/trafficserver のほかの issue

apache/trafficserver の issue をすべて見る

似ている issue

C++ の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。