1Imager::Security(3)   User Contributed Perl Documentation  Imager::Security(3)
2
3
4

NAME

6       Imager::Security - brief notes on security and image processing
7

SYNOPSIS

9         # keep abreast of security updates
10         apt-get update && apt-get upgrade
11         yum upgrade
12         pkgin update && pkgin upgrade
13         # or local equivalent
14
15         # limit memory use
16         use Imager;
17         # only images that use up to 10MB
18         Imager->set_file_limits(bytes => 10_000_000);
19

DESCRIPTION

21       There's two basic security considerations when dealing with images from
22       an unknown source:
23
24       •   keeping your libraries up to date
25
26       •   limiting the amount of memory used to store images
27
28   Keeping libraries up to date
29       Image file format libraries such as "libpng" or "libtiff" have
30       relatively frequent security updates, keeping your libraries up to date
31       is basic security.
32
33       If you're using user supplied fonts, you will need to keep your font
34       libraries up to date too.
35
36   Limiting memory used
37       With compression, and especially with pointer formats like TIFF, it's
38       possible to store very large images in a relatively small file.
39
40       If you're receiving image data from an untrusted source you should
41       limit the amount of memory that Imager can allocate for a read in image
42       file using the "set_file_limits()" method.
43
44         Imager->set_file_limits(bytes => 10_000_000);
45
46       You may also want to limit the maximum width and height of images read
47       from files:
48
49         Imager->set_file_limits(width => 10_000, height => 10_000,
50                                 bytes => 10_000_000);
51
52       This has no effect on images created without a file:
53
54         # succeeds
55         my $image = Imager->new(xsize => 10_001, ysize => 10_001);
56
57       You can reset to the defaults with:
58
59         Imager->set_file_limits(reset => 1);
60

AUTHOR

62       Tony Cook <tonyc@cpan.org>
63
64
65
66perl v5.32.1                      2021-01-27               Imager::Security(3)
Impressum