timothyandClaude Opus 5.5
f30a54172b
security.imagesharp-3x-tiff-decoder-disabled now says the bounds are
enforced by ImageSharpSurfaceTests rather than by its own prose. The
"Load pass is masked" claim is dropped from the record and from the two
code comments that repeated it: with the architecture pin, reverting the
Load pass's options alone now reddens
Only_ImageSharpDecoding_constructs_DecoderOptions (witnessed
2026-10-27), so the claim had become false. The residual it cannot see,
an extension-dispatched Save(path), is named.
Renovate: a packageRule holds SixLabors.ImageSharp on 3.1.x. The
existing "range pins are respected" sentence in ci-cd.md and the EF
group's description were wrong: Dependency Dashboard #22 offers EF Core
v10 and MediatR 14.2.0 over their range pins, so a range does not hold
Renovate. Whether the rule holds the OSV security PR (#923) cannot be
measured before merge, and the record says so.
guard-inventory.md's hand-written C# guard list gains the new fixture
and its two Architecture.Tests siblings, and stops quoting a count.
This branch also edits the rationale prose of
ffmpeg.remote-image-fetcher-bounded (commit 73045865f: the MaxFrames
measurement is dated to 3.1.12 and TIFF is no longer in play), which
the decisions lifecycle check requires this trailer for.
Decisions-Edit: yes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: f9ce6bc6-5b36-491a-8d72-89c1f70dd3e1
48 lines
2.3 KiB
C#
48 lines
2.3 KiB
C#
using SixLabors.ImageSharp;
|
|
using SixLabors.ImageSharp.Formats;
|
|
using SixLabors.ImageSharp.Formats.Bmp;
|
|
using SixLabors.ImageSharp.Formats.Gif;
|
|
using SixLabors.ImageSharp.Formats.Jpeg;
|
|
using SixLabors.ImageSharp.Formats.Pbm;
|
|
using SixLabors.ImageSharp.Formats.Png;
|
|
using SixLabors.ImageSharp.Formats.Qoi;
|
|
using SixLabors.ImageSharp.Formats.Tga;
|
|
using SixLabors.ImageSharp.Formats.Webp;
|
|
|
|
namespace ErsatzTV.Infrastructure.Images;
|
|
|
|
/// <summary>
|
|
/// The ImageSharp <see cref="Configuration" /> every ImageSharp decode in ErsatzTV goes through.
|
|
/// </summary>
|
|
/// <remarks>
|
|
/// It registers every format <see cref="Configuration.Default" /> registers EXCEPT TIFF, so a TIFF is
|
|
/// rejected with <see cref="UnknownImageFormatException" /> before any TIFF decoder code runs.
|
|
/// ImageSharp 3.1.12's TIFF decoder carries GHSA-v76p-62qx-wwq2 (heap out-of-bounds write from a tiled
|
|
/// fax TIFF) and GHSA-wmxv-xphr-5c9g (non-progressing BigTIFF IFD loop). TIFF is outside the artwork
|
|
/// allow-list (<c>ImageContentTypes.Accepted</c>), so what this removes is only a remote-URL or on-disk
|
|
/// TIFF graphic. It is a fresh instance rather than a <c>Configuration.Default.Clone()</c> because
|
|
/// Clone is shallow: removing a detector from the clone would remove it from Default too.
|
|
/// <c>ImageSharpDecodingTests</c> pins the module list against <c>Configuration.Default</c>, so a
|
|
/// package bump that adds a format fails a test instead of silently dropping it, and
|
|
/// <c>ImageSharpSurfaceTests</c> (ErsatzTV.Architecture.Tests) fails any production decode that does not
|
|
/// take these options.
|
|
/// Rationale and revisit trigger: <c>security.imagesharp-3x-tiff-decoder-disabled</c>. (ersatztv#929)
|
|
/// </remarks>
|
|
public static class ImageSharpDecoding
|
|
{
|
|
public static Configuration Configuration { get; } = new(
|
|
new PngConfigurationModule(),
|
|
new JpegConfigurationModule(),
|
|
new GifConfigurationModule(),
|
|
new BmpConfigurationModule(),
|
|
new PbmConfigurationModule(),
|
|
new TgaConfigurationModule(),
|
|
new WebpConfigurationModule(),
|
|
new QoiConfigurationModule());
|
|
|
|
public static DecoderOptions Options() => new() { Configuration = Configuration };
|
|
|
|
public static DecoderOptions Options(uint maxFrames) =>
|
|
new() { Configuration = Configuration, MaxFrames = maxFrames };
|
|
}
|