FEATURE: Replace the default ImageMagick policy.xml (#483)

* Replace the default ImageMagick policy.xml

Replace the default ImageMagick policy.xml with a file containing some resource limitiations. The intention is to stop exceptionally oversized images (and/or malformed images) from consuming all resources on a system.

The values provided should provide ample resources for any reasonable image to be processed without hinderance.

diff --git a/templates/web.template.yml b/templates/web.template.yml
index 6dd9f69032860f42884460462648f59a637838dd..12fc636fe16ae78c21a49543e6c61504d7113d78 100644 (file)
--- a/templates/web.template.yml
+++ b/templates/web.template.yml
@@ -300,3 +300,85 @@ run:
      chmod: 644
      contents: |
         cd $home
+
+  - file:
+     path: /usr/local/etc/ImageMagick-7/policy.xml
+     contents: |
+        <?xml version="1.0" encoding="UTF-8"?>
+        <!DOCTYPE policymap [
+          <!ELEMENT policymap (policy)+>
+          <!ATTLIST policymap xmlns CDATA #FIXED ''>
+          <!ELEMENT policy EMPTY>
+          <!ATTLIST policy xmlns CDATA #FIXED '' domain NMTOKEN #REQUIRED
+            name NMTOKEN #IMPLIED pattern CDATA #IMPLIED rights NMTOKEN #IMPLIED
+            stealth NMTOKEN #IMPLIED value CDATA #IMPLIED>
+        ]>
+        <!--
+          Configure ImageMagick policies.
+
+          Domains include system, delegate, coder, filter, path, or resource.
+
+          Rights include none, read, write, execute and all.  Use | to combine them,
+          for example: "read | write" to permit read from, or write to, a path.
+
+          Use a glob expression as a pattern.
+
+          Suppose we do not want users to process MPEG video images:
+
+            <policy domain="delegate" rights="none" pattern="mpeg:decode" />
+
+          Here we do not want users reading images from HTTP:
+
+            <policy domain="coder" rights="none" pattern="HTTP" />
+
+          The /repository file system is restricted to read only.  We use a glob
+          expression to match all paths that start with /repository:
+
+            <policy domain="path" rights="read" pattern="/repository/*" />
+
+          Lets prevent users from executing any image filters:
+
+            <policy domain="filter" rights="none" pattern="*" />
+
+          Any large image is cached to disk rather than memory:
+
+            <policy domain="resource" name="area" value="1GP"/>
+
+          Define arguments for the memory, map, area, width, height and disk resources
+          with SI prefixes (.e.g 100MB).  In addition, resource policies are maximums
+          for each instance of ImageMagick (e.g. policy memory limit 1GB, -limit 2GB
+          exceeds policy maximum so memory limit is 1GB).
+
+          Rules are processed in order.  Here we want to restrict ImageMagick to only
+          read or write a small subset of proven web-safe image types:
+
+            <policy domain="delegate" rights="none" pattern="*" />
+            <policy domain="filter" rights="none" pattern="*" />
+            <policy domain="coder" rights="none" pattern="*" />
+            <policy domain="coder" rights="read|write" pattern="{GIF,JPEG,PNG,WEBP}" />
+        -->
+        <policymap>
+          <!-- <policy domain="system" name="shred" value="2"/> -->
+          <!-- <policy domain="system" name="precision" value="6"/> -->
+          <!-- <policy domain="system" name="memory-map" value="anonymous"/> -->
+          <!-- <policy domain="system" name="max-memory-request" value="256MiB"/> -->
+          <!-- <policy domain="resource" name="temporary-path" value="/tmp"/> -->
+          <policy domain="resource" name="memory" value="1GiB"/>
+          <policy domain="resource" name="map" value="2GiB"/>
+          <policy domain="resource" name="width" value="64KP"/>
+          <policy domain="resource" name="height" value="64KP"/>
+          <!-- <policy domain="resource" name="list-length" value="128"/> -->
+          <policy domain="resource" name="area" value="4GP"/>
+          <policy domain="resource" name="disk" value="8GiB"/>
+          <!-- <policy domain="resource" name="file" value="768"/> -->
+          <!-- <policy domain="resource" name="thread" value="4"/> -->
+          <!-- <policy domain="resource" name="throttle" value="0"/> -->
+          <!-- <policy domain="resource" name="time" value="3600"/> -->
+          <!-- <policy domain="coder" rights="none" pattern="MVG" /> -->
+          <policy domain="module" rights="none" pattern="{PS,PS2,PS3,EPS,PDF,XPS}" />
+          <!-- <policy domain="delegate" rights="none" pattern="HTTPS" /> -->
+          <!-- <policy domain="path" rights="none" pattern="@*" /> -->
+          <!-- <policy domain="cache" name="memory-map" value="anonymous"/> -->
+          <!-- <policy domain="cache" name="synchronize" value="True"/> -->
+          <!-- <policy domain="cache" name="shared-secret" value="passphrase" stealth="true"/> -->
+        </policymap>