From 5dcc0711ebdb8fc9fbd7b04800df4792f9736fcb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= <323649642+oc-tmueller@users.noreply.github.com> Date: Fri, 11 Sep 2026 12:43:37 +0200 Subject: [PATCH] fix: harden ImageMagick policy and install rsvg-convert (OC10-164) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Neither owncloud-docker/ubuntu, php, base nor server ship any ImageMagick policy.xml or MAGICK_CONFIGURE_PATH override - the product runs on whatever the OS imagemagick-6-common package defaults to, which denies neither the MSL/MVG/MSVG script coders nor the EPHEMERAL/TEXT/SHOW/WIN/PLT/LABEL/ CAPTION/PANGO coders. Confirmed against the real published owncloud/server :11.0.0 and :10.16.4 images: readImage("msl:...") and the SVG /MVG "image" primitive vectors that owncloud/core's OC10-164 fix addresses in application code are not blocked by ImageMagick's own policy at all. Deny MSL, MVG, MSVG, EPHEMERAL, TEXT, SHOW, WIN, PLT, LABEL, CAPTION and PANGO coders, plus the URL/HTTPS/HTTP/FTP delegates, matching the ticket's Item A recommendation. Deliberately does not touch the PS/PDF/EPS/XPS coders or add a blanket delegate/coder deny-all: ownCloud's PDF and Postscript previews decode through the Ghostscript delegate, and a deny-all would break them - upstream ImageMagick's own hardening advice warns against exactly that. Also install librsvg2-bin (missing in both real images - only the .so from librsvg2-common was present, not the rsvg-convert binary). ImageMagick's delegates.xml routes SVG decoding to rsvg-convert; without the binary on PATH it silently falls through to ImageMagick's own internal SVG/MSVG coder, the exact vulnerable path. This is a second, independent layer: it protects any future code path that reads SVG content through Imagick, not just the one owncloud/core patches. Verified by building v24.04 locally and replicating the v22.04 package set on a bare ubuntu:22.04 container (v22.04's own Dockerfile needs a private Freexian mirror secret this environment doesn't have): msl:, the SVG xlink:href="MSL:..." PoC payload, and an MVG "image" primitive referencing msl: are all blocked by policy on both; a real PDF and a legitimate SVG both still render correctly afterward. Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> --- CHANGELOG.md | 9 +++++ v22.04/Dockerfile.multiarch | 1 + v22.04/overlay/etc/ImageMagick-6/policy.xml | 45 +++++++++++++++++++++ v24.04/Dockerfile.multiarch | 1 + v24.04/overlay/etc/ImageMagick-6/policy.xml | 45 +++++++++++++++++++++ 5 files changed, 101 insertions(+) create mode 100644 v22.04/overlay/etc/ImageMagick-6/policy.xml create mode 100644 v24.04/overlay/etc/ImageMagick-6/policy.xml diff --git a/CHANGELOG.md b/CHANGELOG.md index 940a4c2..5cb34dc 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,14 @@ # Changelog +## 2026-09-11 + +* Security + * Ship a restrictive ImageMagick policy denying the MSL/MVG/MSVG script + coders and the EPHEMERAL/URL/HTTP/HTTPS/FTP delegates, and install + `librsvg2-bin` so ImageMagick delegates SVG decoding to `rsvg-convert` + instead of falling back to its own coder when the binary is missing + (OC10-164) + ## 2026-07-06 * Added diff --git a/v22.04/Dockerfile.multiarch b/v22.04/Dockerfile.multiarch index 9c1922d..461580e 100644 --- a/v22.04/Dockerfile.multiarch +++ b/v22.04/Dockerfile.multiarch @@ -50,6 +50,7 @@ RUN apt-get update -y && \ exiftool \ sqlite3 \ librsvg2-common \ + librsvg2-bin \ ghostscript && \ apt-add-repository -r "https://deb.owncloud.com/php.freexian.com/" -y && \ rm -rf /etc/apache2/envvars /etc/apache2/conf-* /etc/apache2/sites-* /var/log/apache2/* && \ diff --git a/v22.04/overlay/etc/ImageMagick-6/policy.xml b/v22.04/overlay/etc/ImageMagick-6/policy.xml new file mode 100644 index 0000000..dbce514 --- /dev/null +++ b/v22.04/overlay/etc/ImageMagick-6/policy.xml @@ -0,0 +1,45 @@ + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/v24.04/Dockerfile.multiarch b/v24.04/Dockerfile.multiarch index 4c55072..44b1045 100644 --- a/v24.04/Dockerfile.multiarch +++ b/v24.04/Dockerfile.multiarch @@ -40,6 +40,7 @@ RUN apt-get update -y && \ exiftool \ sqlite3 \ librsvg2-common \ + librsvg2-bin \ ghostscript && \ rm -rf /etc/apache2/envvars /etc/apache2/conf-* /etc/apache2/sites-* /var/log/apache2/* && \ a2enmod rewrite headers env dir mime expires remoteip && \ diff --git a/v24.04/overlay/etc/ImageMagick-6/policy.xml b/v24.04/overlay/etc/ImageMagick-6/policy.xml new file mode 100644 index 0000000..e0f28f9 --- /dev/null +++ b/v24.04/overlay/etc/ImageMagick-6/policy.xml @@ -0,0 +1,45 @@ + + + + + +]> + + + + + + + + + + + + + + + + + + + + + + + + + + +