4 ms·
Does Pillow have good security tests like fuzzing? Is it safe to pass arbitrary user input (file upload) to Pillow and Pillow-SIMD?
by wolf550e 10y ago
Does Pillow have good security tests like fuzzing? Is it safe to pass arbitrary user input (file upload) to Pillow and Pillow-SIMD?
- wiredfool 10y agoFuzzing is slow. I've tried afl against a small subset of images and I was getting about 10 tries per sec per core. There have been some bugs that look like people have been successfully fuzzing, but there's nothing organized. The goal is certainly to be safe against user input, I would say we're there, but we're better off than we were 6months ago.
- tacos 10y agoAt the next major rev, Image.DecompressionBombWarning probably should default to error instead of warning.