Input sanitization: Limits on size and intensiveness of output of GraphicsMagick

[karlht]

Reference: http://www.graphicsmagick.org/GraphicsMagick.html

Under the 'Environment' section of the above man page, we should consider setting most if not all of the MAGICK_LIMIT_* variables, so that e.g. a very small PostScript input doesn't wind up rasterizing to a multi-gigabyte output.

Other resource-limiting schemes may also be good to have; it would be good if one misbehaving conversion did not bring all other avatar uploading to a screeching halt, for instance.

Does anyone else have any other specific concerns around input/image validation/sanitization?

[seanmonstar]

any recommended settings (names and defaults) and I'll add them.

[seanmonstar]

@karlht ping?

[karlht]

Chatted with jrgm about this last week but ran out of time to get some limits written down. I'll get some suggestions recorded in this issue tomorrow or Wednesday.

[karlht]

My suggestions (per invocation):
disk -- 2MB
files -- 8
map -- 2MB
memory -- 1MB
pixels -- 16K
threads -- 8

/cc @jrgm -- he may have different ideas about what's reasonable.

[shane-tomlinson]

From triage, at a minimum, we should restrict file size and file type.

[rfk]

Since we're now seeing lots more traffic on avatar endpoints, let's prioritize this