From 55bf6b851d702979d40fa74a2356ae59e10faabc Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Wed, 28 Oct 2026 11:35:47 +0400
Subject: [PATCH] build: bump exif_stripper to 0.1.3

0.1.3 strips GPS data from XMP (including DJI drone positions), reads
TIFF descriptions, and no longer reads whole images into memory.
---
 changelog.d/exif-heic-gps.security               |   2 +-
 mix.exs                                          |   2 +-
 mix.lock                                         |   2 +-
 test/fixtures/dji_gps.jpg                        | Bin 0 -> 4213 bytes
 test/fixtures/xmp_gps.jpg                        | Bin 0 -> 3917 bytes
 .../upload/filter/exif/strip_location_test.exs   |  15 +++++++++++++++
 6 files changed, 18 insertions(+), 3 deletions(-)
 create mode 100644 test/fixtures/dji_gps.jpg
 create mode 100644 test/fixtures/xmp_gps.jpg

diff --git a/changelog.d/exif-heic-gps.security b/changelog.d/exif-heic-gps.security
index 0ca439d0c..0b6593f5f 100644
--- a/changelog.d/exif-heic-gps.security
+++ b/changelog.d/exif-heic-gps.security
@@ -1 +1 @@
-Strip GPS data from WebP and HEIC/AVIF uploads; the Exiftool.StripLocation filter used to skip them
+Strip GPS data from WebP and HEIC/AVIF uploads; the Exiftool.StripLocation filter used to skip them; GPS data in XMP (including DJI drone positions) is stripped too
diff --git a/mix.exs b/mix.exs
index 6527f902b..6c2cfe9c9 100644
--- a/mix.exs
+++ b/mix.exs
@@ -205,7 +205,7 @@ defmodule Pleroma.Mixfile do
       {:majic, "~> 1.2"},
       {:open_api_spex, "~> 3.22"},
       {:ecto_psql_extras, "~> 0.8"},
-      {:exif_stripper, "~> 0.1.2"},
+      {:exif_stripper, "~> 0.1.3"},
       {:vix, "~> 0.36"},
       {:elixir_make, "~> 0.7.8", override: true},
       {:blurhash, "~> 0.1.0", hex: :rinpatch_blurhash},
diff --git a/mix.lock b/mix.lock
index 4fbcc257f..8904e6aa6 100644
--- a/mix.lock
+++ b/mix.lock
@@ -47,7 +47,7 @@
   "ex_doc": {:hex, :ex_doc, "0.38.2", "504d25eef296b4dec3b8e33e810bc8b5344d565998cd83914ffe1b8503737c02", [:mix], [{:earmark_parser, "~> 1.4.44", [hex: :earmark_parser, repo: "hexpm", optional: false]}, {:makeup_c, ">= 0.1.0", [hex: :makeup_c, repo: "hexpm", optional: true]}, {:makeup_elixir, "~> 0.14 or ~> 1.0", [hex: :makeup_elixir, repo: "hexpm", optional: false]}, {:makeup_erlang, "~> 0.1 or ~> 1.0", [hex: :makeup_erlang, repo: "hexpm", optional: false]}, {:makeup_html, ">= 0.1.0", [hex: :makeup_html, repo: "hexpm", optional: true]}], "hexpm", "732f2d972e42c116a70802f9898c51b54916e542cc50968ac6980512ec90f42b"},
   "ex_machina": {:hex, :ex_machina, "2.8.0", "a0e847b5712065055ec3255840e2c78ef9366634d62390839d4880483be38abe", [:mix], [{:ecto, "~> 2.2 or ~> 3.0", [hex: :ecto, repo: "hexpm", optional: true]}, {:ecto_sql, "~> 3.0", [hex: :ecto_sql, repo: "hexpm", optional: true]}], "hexpm", "79fe1a9c64c0c1c1fab6c4fa5d871682cb90de5885320c187d117004627a7729"},
   "ex_syslogger": {:hex, :ex_syslogger, "1.5.2", "72b6aa2d47a236e999171f2e1ec18698740f40af0bd02c8c650bf5f1fd1bac79", [:mix], [{:poison, ">= 1.5.0", [hex: :poison, repo: "hexpm", optional: true]}, {:syslog, "~> 1.1.0", [hex: :syslog, repo: "hexpm", optional: false]}], "hexpm", "ab9fab4136dbc62651ec6f16fa4842f10cf02ab4433fa3d0976c01be99398399"},
-  "exif_stripper": {:hex, :exif_stripper, "0.1.2", "fa176be937201366545c8c93b5d89b6e2da1ee00534c3f1fb931402e03262755", [:mix], [], "hexpm", "5c524f7cc061826a6108b7b6f85d1d2481d0cff4ce0a678aaedd6edaa0d86dcb"},
+  "exif_stripper": {:hex, :exif_stripper, "0.1.3", "b3d89a623bb49c09fbe45fe5d4f1becee0ffe011bcade174c3bb91cdae59745e", [:mix], [], "hexpm", "e1ab26d766205ae54be57c19ec70d408b020f3c31855b49d53a55460de81c6e1"},
   "exile": {:hex, :exile, "0.10.0", "b69e2d27a9af670b0f0a0898addca0eda78f6f5ba95ccfbc9bc6ccdd04925436", [:make, :mix], [{:elixir_make, "~> 0.6", [hex: :elixir_make, repo: "hexpm", optional: false]}], "hexpm", "c62ee8fee565b5ac4a898d0dcd58d2b04fb5eec1655af1ddcc9eb582c6732c33"},
   "expo": {:hex, :expo, "0.5.1", "249e826a897cac48f591deba863b26c16682b43711dd15ee86b92f25eafd96d9", [:mix], [], "hexpm", "68a4233b0658a3d12ee00d27d37d856b1ba48607e7ce20fd376958d0ba6ce92b"},
   "fast_html": {:hex, :fast_html, "2.5.0", "23578c1c1fa03db6a3786d78218b2d944df34b0fc3729e72de912f390913c80f", [:make, :mix], [{:elixir_make, "~> 0.4", [hex: :elixir_make, repo: "hexpm", optional: false]}, {:nimble_pool, "~> 1.1", [hex: :nimble_pool, repo: "hexpm", optional: false]}], "hexpm", "69eb46ed98a5d9cca1ccd4a5ac94ce5dd626fc29513fbaa0a16cd8b2da67ae3e"},
diff --git a/test/fixtures/dji_gps.jpg b/test/fixtures/dji_gps.jpg
new file mode 100644
index 0000000000000000000000000000000000000000..7249228cf16b6afe6e96111147a6032fb4a70260
GIT binary patch
literal 4213
zcmeHKTW}Lq7(ScLz3E8Wf~6De_JUiK>}EHqG&@N;r6o`VN7^dl+h+GPS-RN`$%cf^
zI3sxX4e#;>cz;91>w}_reZwo@i}kKAf;W_LCZ63a+a!e<;|xCKWHOU;{{Q>V|9$72
z%>0#;l`p}v&B@6mz%UH(=mRPX?SE%9EyvNcQlNNIO+iXfvviry(F_%$L2R^~<Aph>
z5h<9KlsNhG>u->RB*w|@!&^gJbK@{0ZJN)+>G>OGg!wrkDw3lKZ>-Ffv$-tPc%qz@
zl>%3elLk45e(TFLNf;^GT%4TD@@dF%8_Lq`jH=266Q+ivBqGU+v)t4~(xgDMIBC{e
zDwU{Gm{Rj;nu$iEbcm%{Hi$BUg*}SKmxD@S05Nz8gJS{~guIl~Bvm1FPClg;wKz$7
z36okBEaqG>FB`m~Ktma3p`sO#6AX>$2qGp5oVduQFIBe~lQm;foyn3;%*nixj+5n}
z2xs}CtdWW9A<Pk37^C$nWT^@_CMG^cFWI1)TqB_gS$S1~L2;*KsndN!bK{7`3sK{s
zO?emAxUp10m5Ulgg-Kdbgo$ezHbf1h0xz9n7-WT$vXstfJNVKBOy?m?Fl;@%F<y_}
zC}mT;e50fZ8519jhH7_Tn$SRyD{SG-+9M;>NFBB&wiKl*>8fOw3OAyx*hOLHb{EH)
z!Fu2&OSA$F`Bni9n{2TH^?)fTBNukpoMSjdv9+?6WHb<HbJLoL%1MN%5K{-VBIunN
zx47<>R+rHGMK77Q{tv3J1U;L}I*^3RKU$kK<#EfdmR(Ib&{T5kcD3wk%7LbmTequa
zS5po&mHhwQuEkCcDyV%cp+2qh1sDfzr_<$hxLq!n$K&?;y4rnhZN8NqomX_N>gl~|
zRZk#53{oV~zjh!H7+SYxZHS3PBE4iZKElSRaD>%KFptOMYx8xtw|BFBfj+kBQF#;i
z-2ej^j`ahZAH)4v<v8dC0CS*TRc}|#f!T1o!|8H+ylp7q=rUl#aNK6c9S*x4W#5M4
z!0vZ+^f6=3&TYJ_e^(c~cmF~6!1^P{mQS5HGZ;?g_j$Z4uIygfv-)asXw5Z|;p^6o
zM7i;a4atq0CO1#d+;sEyTXx(kpsp>Qk#-ie;_gy;&-@*C-gWmq_uhB^0}np*@FR~t
z_V|HAho5-zsi&WL_POU@c=6~<FTe8YYj3@M{GE5-d;fzEKl=ESPe1$o<f+pOUw!?}
zx8HsL!;e3m{pHu+e*fd#pMRa#bzuOn%CeL-=<*|7HoG0SyL4Tct%Sa~-|pyRoE>A^
zT>P%ies-_BYyJL%M~-<0!c%9Kr}8JfD+VJAtIz7v3}ydL*uMXy%o4V!>ooA;7&<)M
Q4@SYc^FxPjAFZ7F2g4kKKL7v#

literal 0
HcmV?d00001

diff --git a/test/fixtures/xmp_gps.jpg b/test/fixtures/xmp_gps.jpg
new file mode 100644
index 0000000000000000000000000000000000000000..dd76e84f79ac7ba2a153c9e0cd681e8b5715e64f
GIT binary patch
literal 3917
zcmex=<NpH&0WUXCHwH#VMutQnWcdG(=SoINNr9EVeqOO&VoH8es$Oz_u6{*gfxe-h
zfj)zceMLcHa&~HoLQ-maW}dD3``!E16*5z7)x%AF4SWlnQ!_F>s)|yBtNcQetFn_V
zQ`GJ4xNIt{Dsl^QQ%e#RDspr3imfVa)xm~a0ofp7eRTz}l9Fs&b<f<y^i(S=*NV)v
zko^1{1w&&!Q%iNAAw?-^RzWUqP$PgmTXm>g%gf94%8m8%i_-NCEiEne4UF`SjC6r2
zbc-wVN)jt{^NN*$CU7Z$&2ULAPA<wUD9OyvQvjKnn3P{yVymvsr2sWLB^hpVL1|GA
z*xZz4{nVV)+|<01Vqi!Z>I02aP_Ri!wn{;m1`>i;;h0kb=0JEknIMC$auV~>ZPhDu
zQ&Q6sOLI!p?YvV{3lwrwZS+B|$jO9g2XmnMZS*lLfG9@t0`cBT1%@cxV<^!Jk^#pr
z#8)7$m3u%i&=r{_r75X)#-{p)Hu@OCpb&rw`XoZtnpo(VSm+t}A=JaAP}Jw=r9%ui
z(lG?8cSTYUmjXr@I5^1iE-=Mm_bn_jLp%#qX60Oznpl!w1WIm@NGSobZ1mBkusR3g
zLSVWCrcix&I)}tQFgef^fYKYy!Kfu91@UNbjRqG<AwZJi(bP2>TqK16Ns32P*JyB&
z6apkErcdfZ^iWdsfZdXEVE^O)Z3brs4mLJ+HdYRHc6Lrq4lW)MULJ049!Vi#ei2zI
zc{y1r85so?J#_^o9c39A4RcK$149!N6M1z@TMHu_J!2CikRgnmoSZz|JQBRT5=M$L
zibf=Z{|6WZIT#oj7?~NB7?=bZnFSgDA7PMZU|?hg_Q62iFeqSTVrF4wW9Q)H;sz?%
zD!{<R$jr>d!pzFb!U9xX3zTPI5o8roG<0MW4oqZMDikqloVbuf*=gfJ(V&YTRE(2~
znmD<{#3dx9RMpfqG__1j&CD$<t(;w4-P}Dqy@EqR!@?sXqmqHWk@Sqrtm2Z=vhs?`
zs^*r~w)T$Bu1S-pOr17;#>`oZ7B5-4Z25|nt2S-kvUS_`9Xod&I(+2lvEwIBp1O4T
z%GGPvZ`{1~@X_NZPoF)1@$%KjPoKYh{r3IG&tD*aF)}biyao3en!f~r{$gTbVP;_m
z`HPXM9Eh0(Sy&Yf*@PSe*%J$em5drWM4Tor+<1^v**NHfXj0KdE-@98hpHbzUIY7#
kIFB`v<uka)5dONwz{AW4j67yR2789@zcdy#*#Ex?0Q8I(y#N3J

literal 0
HcmV?d00001

diff --git a/test/pleroma/upload/filter/exif/strip_location_test.exs b/test/pleroma/upload/filter/exif/strip_location_test.exs
index 3291e7aa6..f1bb3b87c 100644
--- a/test/pleroma/upload/filter/exif/strip_location_test.exs
+++ b/test/pleroma/upload/filter/exif/strip_location_test.exs
@@ -26,6 +26,21 @@ defmodule Pleroma.Upload.Filter.Exif.StripLocationTest do
     end
   end
 
+  test "strips GPS data from XMP, including DJI drone positions" do
+    for fixture <- ["xmp_gps.jpg", "dji_gps.jpg"] do
+      upload = upload_copy(fixture, "image/jpeg")
+      assert exiftool_xmp(upload.tempfile) =~ "GPSLatitude"
+
+      assert StripLocation.filter(upload) == {:ok, :filtered}
+      refute exiftool_xmp(upload.tempfile) =~ ~r/GPS|AbsoluteAltitude/
+    end
+  end
+
+  defp exiftool_xmp(path) do
+    {output, 0} = System.cmd("exiftool", ["-m", "-s", "-xmp:all", path])
+    output
+  end
+
   test "keeps other EXIF data in HEIC" do
     upload = upload_copy("strip_location_gps.heic", "image/heic")