Re: security: making sure graphics uploaded by users are safe

in reply to security: making sure graphics uploaded by users are safe

3.5. Check the file with an up to date antivirus
3.6. Use Image::ExifTool. Any warning makes the image suspicious and you must reject it

Comment on Re: security: making sure graphics uploaded by users are safe

Replies are listed 'Best First'.
Re^2: security: making sure graphics uploaded by users are safe by boardhead (Novice) on Oct 01, 2009 at 16:29 UTC
ExifTool is not designed to detect security problems in images, so I don't think that exiftool warnings are very indicative of a problem like this. Instead of rejecting any image with a warning, I would recommend removing all metadata from the image with "`exiftool -all=`". This should also remove any warnings associated with the metadata. If warnings or errors persist after cleaning an image like this, then it would be reasonable to reject the image. - Phil Harvey	[reply] [d/l]

Replies are listed 'Best First'.

Re^2: security: making sure graphics uploaded by users are safe
by boardhead (Novice) on Oct 01, 2009 at 16:29 UTC

ExifTool is not designed to detect security problems in images, so I don't think that exiftool warnings are very indicative of a problem like this. Instead of rejecting any image with a warning, I would recommend removing all metadata from the image with "exiftool -all=". This should also remove any warnings associated with the metadata. If warnings or errors persist after cleaning an image like this, then it would be reasonable to reject the image.

[reply]
[d/l]

In Section Seekers of Perl Wisdom