Added image to custom circuit appearance

[Toshayo]

Added image shape to custom circuit appearance. The image has one attribute: the URL. It is downloaded and shown when the circuit is rendering.
I've also added an option to disable the image download.

[maehne]

This should be at least reviewed/tested also from @BFH-ktt1. The suggested changes look sensible to me. It would be nice if you could provide also some documentation and use case / screenshot of this functionality to demonstrate its usage.

[Toshayo]

The new shape works like a normal rectangle. You can scale it using squares at the corners. When you enter an URL into the image's properties, logisim downloads and shows the image.
The option to disable image load is located in preferences, layout settings. It is true by default :

Here is a random example :

[maehne]

IMHO, it is problematic if images get downloaded dynamically during loading of circuit files. It could cause hard to handle security risks. Restricting it to only local files may be a bit safer. Ideally, the image should be saved as part of the circuit file. In any case, some security risks remain due to manipulated image files causing buffer overflows and similar things.

[maehne]

Thanks anyway for your explanations and illustrative screenshots. I can see a certain value in this functionality, but I am not sure whether it is worth the risk. Therefore, I would like feedback by other regular contributors to this project, i.e., @BFH-ktt1, @davidhutchens, @MarcinOrlowski, @R3dst0ne, @TheEvilSkeleton.

[Toshayo]

Thanks for your fast feedback!

IMHO, it is problematic if images get downloaded dynamically during loading of circuit files. It could cause hard to handle security risks. Restricting it to only local files may be a bit safer. Ideally, the image should be safes as part of the circuit file. In any case, some security risks remain due to manipulated image files causing buffer overflows and similar things.

I imagine some solutions for this :

• The easiest is to set image loading to false by default. Not too secure as it makes the feature useless.
• Add a URL whitelist.
• Proceed like in some tools like Microsoft's Word, ask the user to load or not remote content.
• Use local files as you've suggested.
• Save image pixels in the .circ file. I think it's not the best option as it will increase file size and make it less readable.

I would like to know your opinion about these ideas.

[davidhutchens]

I agree with @maehne about the use of network URLs to load files during startup. We have not used networks for any functionality, and I don't think loading images is a reason to start now. At the least, this would cause .circ files to behave differently if no network is available. At worst, it might have security implications. Therefore, I would reject your first three bullet points. I also note that for Mac users, we actually say in the documentation that you can deny network access to our program without causing any problems.

That leaves using local files to load the original image and either linking to the local file or saving the image in the .circ file. We currently have the ability to link to libraries and other .circ files in our local file system. So linking to image files would not be much different. As with the libraries, it is best to use relative paths so a directory can hold the .circ files and images that are linked. This would provide easy sharing of the package.

[maehne]

Please address the raised security concerns. Personally, I would tend to embed the images inside the circuit file. However, it is important that they get encoded in a way that the circuit files remain pure text XML files.

[Toshayo]

The most common way to encode an image in text is base64, but having images in circ files will increase it size. Even if we resize it, an 640x480 random color JPG image takes about 0.5MB in base64.

[MarcinOrlowski]

I'd not worry the size much, frankly speaking. Since feature is optional to use, if size is a concern, one can just not use it.

[maehne]

I would be OK with base64. Is 640 x 480 pixels or bigger really the size of images, you would typically assign to a circuit symbol? In any case, base64 doesn't prevent using a compressed image format such as PNG or JPEG. In any case, a vector format -- ideally SVG would be preferred to guarantee good quality.

Maybe, the intent/requirements for this enhancements should be first analysed/discussed a bit more in detail before deciding where/how to store the image data.

[Toshayo]

Changes :

• Replaced loading images from internet by URL to loading image from local system.
• Storing the image in base64 form. Image is not resized/modified. If it is just a circuit image like in the example, it should not affect project file size too much.
• Removed option to allow downloads as it is no more useful

[maehne]

@Toshayo: Thanks for this additional work on your PR to incorporate our feedback. Could you please provide a small test case using your feature in form of a ZIP archive including a CIRC file + the used image(s)? This would facilitate testing on our side.

[Toshayo]

Here is same example as a little higher: logisim_image_example.zip
The image is encoded via base64 into the CIRC file.