adalal/gotenberg
1
0
Fork 0
mirror of https://github.com/gotenberg/gotenberg.git synced 2026-08-08 00:22:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix(exiftool): case-insensitive comparison and expanded blocklist

Browse Source
This commit is contained in:
Julien Neuhart
2026-03-31 14:18:44 +02:00
parent c99eb471f9
commit 15050a311b
1 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
pkg/modules/exiftool/exiftool.go
View File

@@ -226,14 +226,22 @@ func (engine *ExifTool) WriteMetadata(ctx context.Context, logger *slog.Logger,
} }
// Filter user-supplied metadata to prevent ExifTool pseudo-tags from // Filter user-supplied metadata to prevent ExifTool pseudo-tags from
// triggering dangerous side effects like file renames or moves. // triggering dangerous side effects like file renames, moves, or link
// creation. Comparison is case-insensitive because ExifTool processes
// tag names case-insensitively.
// See https://exiftool.org/TagNames/Extra.html. // See https://exiftool.org/TagNames/Extra.html.
dangerousTags := []string{ dangerousTags := []string{
"FileName", // Writing this triggers a file rename in ExifTool "FileName", // Writing this triggers a file rename in ExifTool
"Directory", // Writing this triggers a file move in ExifTool "Directory", // Writing this triggers a file move in ExifTool
"HardLink", // Writing this creates a hard link in ExifTool
"SymLink", // Writing this creates a symbolic link in ExifTool
} }
for _, tag := range dangerousTags { for key := range metadata {
delete(metadata, tag) for _, tag := range dangerousTags {
if strings.EqualFold(key, tag) {
delete(metadata, key)
}
}
} }
for key, value := range metadata { for key, value := range metadata {