Add an image format blocklist for imagemagick about libvips HOT 4 CLOSED

Specifically for ImageMagick, I believe it's best to utilize a policy.xml configuration file. For example, we use this one on our public service:

<policymap>
  <policy domain="Undefined" rights="none"/>
  <!--
  Use IM only to read certain image types. Assumes the rest is handled in libvips.
  Note: ICO data can be either a BMP image, or a complete PNG image.
  -->
  <policy domain="delegate" rights="none" pattern="*" />
  <policy domain="filter" rights="none" pattern="*" />
  <policy domain="coder" rights="none" pattern="*" />
  <policy domain="coder" rights="read" pattern="{ICO,BMP,PNG}" />
</policymap>

However, according to https://stackoverflow.com/a/50837362, GraphicsMagick does not have a direct counterpart to this functionality, but I'm not sure if that's a issue there.

from libvips.

I think you're right in a server context.

I was running into this issue with desktop libvips -- an AVI file in a directory is enough to kill vipsdisp :( But desktop users probably don't want to disable all AVI handling in imagemagick, just within libvips (where it's mostly useless).

from libvips.

Ah, you are right. It would indeed make more sense to block slow formats from the *_header() phase. Users who still want to process these files may use vips_magickload() directly, for example:

$ vips magickload x.avi x.jpg

from libvips.

I think we're done, I'll close.

from libvips.