CODEWITHSUNDEEP
phpsecurityimagemagick
0x6C77
0x6C77

Reputation: 939

Safe use of ImageMagick convert

I am planning on using the following to resize animated GIFs.

Would it be recommended to do other checks on the file before passing to convert? The filename is auto-generated in the upload script.

$filename = escapeshellarg($filename);
exec('convert image.gif -resize 150x400^ -gravity center -extent 150x400 ' . $filename);

Upvotes: 2

Views: 274

Answers (2)

Kurt Pfeifle
Kurt Pfeifle

Reputation: 90213

  1. You should use convert with prepending the absolute path to the executable that you want to execute.

  2. You should be sure that you can trust the convert command which you want to execute.

  3. You should prepend the absolute path to the input file which you want to process.

  4. You should check for file size, (magic) file format, pixel dimensions and layer canvas geometry of the input file you want to process. For example:

    identify                                                           \
  -format "%f : bytes=%b format=%m width=%w height=%h canvas=%g\n" \
   /path/to/input/image

    (Make yourself familiar with the meanings of %f, %b, %m, %w, %h and %g here.)

  5. You should prepend the absolute path to the output file which you want to write.

  6. You should be very sure that $filename is not containing unwanted characters.

Upvotes: 2

Kiyan
Kiyan

Reputation: 2193

if file name in not from user input (even part of it) and you generate it with random character or data like user id, and you can be absolutely sure there is no unwanted data or characters in it, there is no need to be worry.

Upvotes: 0

Related Questions