619629 - Resave all uploaded images to get rid of exif data

Status: RESOLVED FIXED

(support.mozilla.org :: General, defect, P1)

Description

[Paul Craciunoiu [:paulc]]

Spin-off as a result of bug 619467 -- we've discussed with infrasec to do 3 things:
1. Limit to certain extensions for uploaded images (for now gif, png, jpe?g)
2. Re-save images to get rid of potentially malicious comments.
3. Rename the files to get rid of our unicode problems (already in bug 596116).


Erik has started some work on resaving images so assigning this to him.

Comment 1

[Wil Clouser [:clouserw]]

If you're looking to liberate/steal code, you can check out https://github.com/jbalogh/zamboni/blob/master/apps/amo/utils.py#L251

Comment 2

[James Socol [:jsocol, :james]]

Surely AMO and SUMO share a bunch of common image handling concepts, though no code. I'd love to take the common stuff (I know we just rethought thumbnail generation but AMO's is so pretty and already resaves everything as .png) and create something lower-level we could both use in commonware.

Comment 3

[Erik Rose [:erik][:erikrose]]

Getting rid of malicious comments doesn't do much for us, as it's just as easy to paste malicious code into the body of the image (and the browser executes it just as readily).

Comment 4

[Michael Coates [:mcoates] (acct no longer active)]

(In reply to comment #3)
> Getting rid of malicious comments doesn't do much for us, as it's just as easy
> to paste malicious code into the body of the image (and the browser executes it
> just as readily).

Yes, if the "image" is served as html then the browser will execute it. However, our image defense consists of multiple layers.  Getting rid of malicious comments (or whatever might be there) is one of many steps in a defense in depth approach.

https://wiki.mozilla.org/WebAppSec/Secure_Coding_Guidelines#Image_Upload

Comment 5

[James Socol [:jsocol, :james]]

I think Tanay will end up doing this as part of bug 630845.

Comment 6

[Tanay Gavankar [:tgavankar]]

Done with the image compression patch: https://github.com/jsocol/kitsune/commit/2bb577. All images are now converted/resaved as PNG.

Comment 7

[Tanay Gavankar [:tgavankar]]

Note that this will result in a filesize increase (small one for png->png, larger one for something like jpg->png).

Comment 8

[Will Kahn-Greene [:willkg] ET needinfo? me]

These bugs are all resolved, so I'm removing the security flag from them.