python-pillow/Pillow
1
1
Fork 0
mirror of https://github.com/python-pillow/Pillow.git synced 2024-09-21 19:38:57 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #7662 from radarhere/imagefont

Browse Source 
Apply ImageFont.MAX_STRING_LENGTH to ImageFont.getmask()
This commit is contained in:
Andrew Murray 2024-01-01 00:14:57 +11:00 committed by GitHub
commit 8a9afb6717
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Tests/test_imagefont.py
View File

@ -1058,6 +1058,8 @@ def test_too_many_characters(font):
imagefont.getlength("A" * 1_000_001) imagefont.getlength("A" * 1_000_001)
with pytest.raises(ValueError): with pytest.raises(ValueError):
imagefont.getbbox("A" * 1_000_001) imagefont.getbbox("A" * 1_000_001)
with pytest.raises(ValueError):
imagefont.getmask("A" * 1_000_001)
@pytest.mark.parametrize( @pytest.mark.parametrize(

15
docs/releasenotes/10.2.0.rst
View File

@ -62,8 +62,19 @@ output only the quantization and Huffman tables for the image.
Security Security
======== ========
Restricted environment keys for ImageMath.eval ImageFont.getmask: Applied ImageFont.MAX_STRING_LENGTH
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
To protect against potential DOS attacks when using arbitrary strings as text input,
Pillow will now raise a :py:exc:`ValueError` if the number of characters passed into
:py:meth:`PIL.ImageFont.ImageFont.getmask` is over a certain limit,
:py:data:`PIL.ImageFont.MAX_STRING_LENGTH`.
This threshold can be changed by setting :py:data:`PIL.ImageFont.MAX_STRING_LENGTH`. It
can be disabled by setting ``ImageFont.MAX_STRING_LENGTH = None``.
ImageMath.eval: Restricted environment keys
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
:cve:`2023-50447`: If an attacker has control over the keys passed to the :cve:`2023-50447`: If an attacker has control over the keys passed to the
``environment`` argument of :py:meth:`PIL.ImageMath.eval`, they may be able to execute ``environment`` argument of :py:meth:`PIL.ImageMath.eval`, they may be able to execute

1
src/PIL/ImageFont.py
View File

@ -149,6 +149,7 @@ class ImageFont:
:return: An internal PIL storage memory instance as defined by the :return: An internal PIL storage memory instance as defined by the
:py:mod:`PIL.Image.core` interface module. :py:mod:`PIL.Image.core` interface module.
""" """
_string_length_check(text)
return self.font.getmask(text, mode) return self.font.getmask(text, mode)
def getbbox(self, text, *args, **kwargs): def getbbox(self, text, *args, **kwargs):