3 ms·
The issue with taking arbitrary user uploads and piping them directly into a program that happily accepts and interprets arbitrary data is security. They claim
by revelation 10y ago
The issue with taking arbitrary user uploads and piping them directly into a program that happily accepts and interprets arbitrary data is security.
They claim support for over 200 formats, some of which surely have exciting scripting functionality that no one ever uses:
http://www.imagemagick.org/script/formats.php http://www.imagemagick.org/script/formats.php
And there have been recent code execution vulnerability reports:
https://imagetragick.com/ https://imagetragick.com/
Now libpng (e.g.) has issues as well but if at all possible I would try to restrict the input format and process only with software for the specific format.