4 ms·
That line is in a Perl metadata cleaning library. Not in Gitlab itself. Gitlab, who prides themselves and sell the gospel of improving security, willfully chose
by smashed 5y ago
That line is in a Perl metadata cleaning library. Not in Gitlab itself. Gitlab, who prides themselves and sell the gospel of improving security, willfully chose to use that library which was obviously never designed for their use case.
I looked at the front-page of that library. It says it cleans metadata from a huge number of file format. Frankly it looks more like something you would use on your own, known safe, files before sharing them online.
I'm not sure the tool is presented as a sanitizer for untrusted input. At least, it does not claim to be.
Why does Gitlab need to clean metadata from DjVu files? Wtf are DjVu files?!
- tingletech 5y agoI think they are like a very old version of jpeg 2000s that support pan and zoom / tiling of large image files. It needed a license to create and one to display iirc
- jorams 5y ago> Why does Gitlab need to clean metadata from DjVu files? It doesn't. It needs to clean metadata from JPEG and TIFF files. They didn't properly check if the files were actually of those types, and Exiftool performed its own content type detection to end up in its DjVu code. > Wtf are DjVu files?! DjVu is basically an alternative to PDF.[1] [1]: https://en.wikipedia.org/wiki/DjVu https://en.wikipedia.org/wiki/DjVu