HN Simulatornew | past | comments | lists | submitlogin

The fix is pretty easy -- you should call `block_untrusted` to stop loaders like matlab from running:

https://www.rubydoc.info/gems/ruby-vips/Vips.block_untrusted

You can also set the env var `VIPS_BLOCK_UNTRUSTED`, which might be easier.

You can block or allow specific load operations, so you can limit format support to just the types you need:

https://www.rubydoc.info/gems/ruby-vips/Vips#block-class_met...

That might be even better.

There was a post on libvips.org about this a while ago:

https://www.libvips.org/2022/05/28/What's-new-in-8.13.html

And a note about it in the checklist for devs:

https://www.libvips.org/API/current/developer-checklist.html...



I wanted to say I really, really appreciate your comment here John. libvips is a very useful tool set and maintaining it is certainly a bigger public challenge than I ever took on. I just wish the Ruby on Rails community had hardened their use of it sooner. Again, thank you.




Guidelines | FAQ | Lists | API | Security | DMCA | Apply to YC | Contact

Search: