From d1deb9da4546ef27c426c0cd98e9dad6adbaaa7f Mon Sep 17 00:00:00 2001 From: Lain Soykaf Date: Tue, 27 Oct 2026 18:07:45 +0400 Subject: [PATCH] build: bump exif_stripper to 0.1.2 0.1.2 handles gridded HEIC photos (as iPhones write them), PNG files with data after IEND and TIFF files, and bounds HEIC parsing by the input size. Add tests for these files. --- mix.exs | 2 +- mix.lock | 2 +- test/fixtures/strip_location_gps.tiff | Bin 0 -> 9038 bytes test/fixtures/strip_location_gps_grid.heic | Bin 0 -> 12530 bytes .../upload/filter/exif/strip_location_test.exs | 12 ++++++++++-- 5 files changed, 12 insertions(+), 4 deletions(-) create mode 100644 test/fixtures/strip_location_gps.tiff create mode 100644 test/fixtures/strip_location_gps_grid.heic diff --git a/mix.exs b/mix.exs index fc2d70b48..6527f902b 100644 --- a/mix.exs +++ b/mix.exs @@ -205,7 +205,7 @@ defmodule Pleroma.Mixfile do {:majic, "~> 1.2"}, {:open_api_spex, "~> 3.22"}, {:ecto_psql_extras, "~> 0.8"}, - {:exif_stripper, "~> 0.1.1"}, + {:exif_stripper, "~> 0.1.2"}, {:vix, "~> 0.36"}, {:elixir_make, "~> 0.7.8", override: true}, {:blurhash, "~> 0.1.0", hex: :rinpatch_blurhash}, diff --git a/mix.lock b/mix.lock index aaa944985..4fbcc257f 100644 --- a/mix.lock +++ b/mix.lock @@ -47,7 +47,7 @@ "ex_doc": {:hex, :ex_doc, "0.38.2", "504d25eef296b4dec3b8e33e810bc8b5344d565998cd83914ffe1b8503737c02", [:mix], [{:earmark_parser, "~> 1.4.44", [hex: :earmark_parser, repo: "hexpm", optional: false]}, {:makeup_c, ">= 0.1.0", [hex: :makeup_c, repo: "hexpm", optional: true]}, {:makeup_elixir, "~> 0.14 or ~> 1.0", [hex: :makeup_elixir, repo: "hexpm", optional: false]}, {:makeup_erlang, "~> 0.1 or ~> 1.0", [hex: :makeup_erlang, repo: "hexpm", optional: false]}, {:makeup_html, ">= 0.1.0", [hex: :makeup_html, repo: "hexpm", optional: true]}], "hexpm", "732f2d972e42c116a70802f9898c51b54916e542cc50968ac6980512ec90f42b"}, "ex_machina": {:hex, :ex_machina, "2.8.0", "a0e847b5712065055ec3255840e2c78ef9366634d62390839d4880483be38abe", [:mix], [{:ecto, "~> 2.2 or ~> 3.0", [hex: :ecto, repo: "hexpm", optional: true]}, {:ecto_sql, "~> 3.0", [hex: :ecto_sql, repo: "hexpm", optional: true]}], "hexpm", "79fe1a9c64c0c1c1fab6c4fa5d871682cb90de5885320c187d117004627a7729"}, "ex_syslogger": {:hex, :ex_syslogger, "1.5.2", "72b6aa2d47a236e999171f2e1ec18698740f40af0bd02c8c650bf5f1fd1bac79", [:mix], [{:poison, ">= 1.5.0", [hex: :poison, repo: "hexpm", optional: true]}, {:syslog, "~> 1.1.0", [hex: :syslog, repo: "hexpm", optional: false]}], "hexpm", "ab9fab4136dbc62651ec6f16fa4842f10cf02ab4433fa3d0976c01be99398399"}, - "exif_stripper": {:hex, :exif_stripper, "0.1.1", "4e9d682fecee3532974126894bc41629d7346702b51ee6d969c98ae78313328d", [:mix], [], "hexpm", "bd62115d7eb0d0458b2c92aeb4e54df8946b136113556cda7e2b572b638c1535"}, + "exif_stripper": {:hex, :exif_stripper, "0.1.2", "fa176be937201366545c8c93b5d89b6e2da1ee00534c3f1fb931402e03262755", [:mix], [], "hexpm", "5c524f7cc061826a6108b7b6f85d1d2481d0cff4ce0a678aaedd6edaa0d86dcb"}, "exile": {:hex, :exile, "0.10.0", "b69e2d27a9af670b0f0a0898addca0eda78f6f5ba95ccfbc9bc6ccdd04925436", [:make, :mix], [{:elixir_make, "~> 0.6", [hex: :elixir_make, repo: "hexpm", optional: false]}], "hexpm", "c62ee8fee565b5ac4a898d0dcd58d2b04fb5eec1655af1ddcc9eb582c6732c33"}, "expo": {:hex, :expo, "0.5.1", "249e826a897cac48f591deba863b26c16682b43711dd15ee86b92f25eafd96d9", [:mix], [], "hexpm", "68a4233b0658a3d12ee00d27d37d856b1ba48607e7ce20fd376958d0ba6ce92b"}, "fast_html": {:hex, :fast_html, "2.5.0", "23578c1c1fa03db6a3786d78218b2d944df34b0fc3729e72de912f390913c80f", [:make, :mix], [{:elixir_make, "~> 0.4", [hex: :elixir_make, repo: "hexpm", optional: false]}, {:nimble_pool, "~> 1.1", [hex: :nimble_pool, repo: "hexpm", optional: false]}], "hexpm", "69eb46ed98a5d9cca1ccd4a5ac94ce5dd626fc29513fbaa0a16cd8b2da67ae3e"}, diff --git a/test/fixtures/strip_location_gps.tiff b/test/fixtures/strip_location_gps.tiff new file mode 100644 index 0000000000000000000000000000000000000000..afbc4ac5834b21da059f761f2d5eaf4a7bbcbe13 GIT binary patch literal 9038 zcmeHLcUV-{w%_N>nL-l{qz=6+SjS<2p$y}|ARsnkP{G(m6l`cz)S%Ib zK&+@iqp|mPF@^|A493`v-nC~yhkNtg``-8ddmm@Mea>&MUDn#awe~t^c1#R%LP)Cx zk()?FA%qAhftzTbG1L)aLcuK*Ns}WI?qn?75Q*q;$I`iQm&?atIrT|i3kZ+J1tEr9 zj`3c39U(_};`%VflNAWh3@DL`x_nM(*Zi(u4i7|p9J+=W7-C?EfguKl7#Lz;h=Cyn zh8P%PV2FVs28I|IV&MNh14tK+1Qcfxfp8o^C}FZ6vp`Pk$IzKzC}CA4to`Y%qlM5> zlItsBgMN&484mQ zEG`fW@pJI?^19+Y=87wxYjE3tt5^*0mouk+p!jMqFU!MDT>E)LY-bL&Wpvm0s)^E7RuKPbq1>_J2?X6 z9)OdJq{( zt5BSR`Ggo@-bbkf9|=(bng(|P5~Bx*g9?!d70Xc;;-h>h9I(IzN;vcqLyg zEWll#+HoC^z++sI1lkHvCiKmNkpprLoF@wVN8(uupx|+M=5G1Sf_{x|pfT9uYb1mA zY}5edXv&}B%C$+MM=5fZ%SX#)16n_?9IvhClh)~AtMclV z85>~vIPg^jGv~ny#r^ygf;I2K?%e*-pV^daTxKG3lt^lpB=9D01AAfR71Ajp!G)!L z9p#6N5a;^hV`mU&w^r+E`Fb!joNH9e#4G9@<^RE}pS?L?+hDK8DaVaGk~01+Za^3P zGW{a`KK&}}HrhGFfm$2wIIUHVcGC{Q@7qt~2JZ+3$AfnSj!!}V4#2A~>W@L? zy`r2Ius`rT*c-V20EapKJ6kzcG2_ZHgt`2mS)|PM;0&VhzI>OmZP@N?CfkYa$qr%@ zY%BPAumb_vu&vqAY(r>`U^}ow*ruQO81PsgNN@z<$om|NioBNwRt`iOUSBqNUnl!(OR*5s9NO_+T8nBZUniM%?K<5Cjat{y6pedk9gl2#pQs5P52QlOx&Y(Ux zcjK%D5l>8z`|xjKl;Ov4V1zOpV5}lraTpXDFtrJ(L7X%s?jpE8m&Vc(N@%mn$SLU z5FJ9t(GTb>x`?i!JMaeTLQha1dWqf<1i>UU2wlRMuq5mVXTpQZ-dTDPc2Bk}JC|B@J1eHPwsOi*fYB9Br+Ceo_C#fsc1FDbu zK-Zv~(VgjjbRK;?J&QhrUP-T^Z=)ZepMtF2MSsa)Fbp6rydhrF7&(lYjKz%gj6IBF zj7yA%j2BEM)0pYZ^k>E~`OG3_C37uvH}fd-GP8^Mnx)3FWO=Z{Sm`V=tAbU-+Q~Y? zy3BgSdZ(hLVyEJ#5~q@(QmV34Wvfb?$_14!m3OMzst&6Ds>!N3s`FH9Rhv{#soqt6 zuBN7Dt>&wipe9nAt5&PFSM9Xg1GP8mI_gg9!Riy$W$H`Rx2qphzoq_MLqo$}BTyq< zqex?kMx(|Fjr$s}*}7~uHjkabp2MzVH?uFZpK7XT+Gz%9PSz~btkK-Bc|o&ROGV3G zD_D!KHCwArt5xfU)(dT2ZFlWB?R@RU+B>z+Xm{%{b?kLQbux73>uk|Eq4Q9erfZ`c ztSiv{LU*g~DcvqThMt2SPcKKWTJIaZ^Ll;yI{G8^Q}s*q>+}!ncN)+P>^ zCNoSnn4B`{HPtg6WhyYOGTmo-+l(}GGD|d@X|~1eoY@O=3-fSuiTPUd6Xv}Z1{Q%9 zIToudj#%_q>ROJm6j`paJZkxvqt6NAyhaGONv2=dIpZJ6NY!S6J_{ zzGtIq<71O)v&yF3rq9;WHpaHxc9-pKI~6-0yKK8Pb{%%F>>cdK*)Om^Xy5H%Wjh~lak>5VQ-$%KQ${n?HRQG6y(ZbPNM?dtp_UHR= z_U|0S88davrZJrXRssBghJc>~Z2~g_w*@{58Wxljv^(hOSngQq*aKr<1^Wfh3O*J> z3keUY3OOID6PgmbF7$qwby!x|uCTsv&+wVy$0FzvQ4z}{Zt%=`0$wApFVZ`5R^-Vj z^{Aw%bx}V@J4H*Q+hWL=$e5KecVq2h#jywDP#iCAW!$}ZhxqC7-zP8<;uGo;eob^w zEKlr6(oLF@v@_{t^4R31$#+s5Q)DUashX)1QyWuXjSCsKVqE9=;p1nGKbvNfCQ55b zXQrp7Z%cnMA#}p(30)ICCst0pKFMKH$)q!rO(y3}K0HNp3V+J}sr0GirtX~jo*&0= z;J=v0n^r%qPY^6vBY2V#n6WCON9ZqHA$*kSpSdElJIg<7WmZpiKz2=buP9iwPV_7% zB4=aHtK7KU?YSTG#^vqFXXQ`LZx!o^bHyhMEDA~rE=imvm6Fcse$!V^?~_JJw-pkF zlL}jk^x#kFIhmvEOWA|sF~xPouVs>QuU@^if$@+1E3vnSz<^i3HUi+}ve{j1uqJ}${za(=1T z(hbWP%f!pBFArG0V}d)0vR-dUES+jAC>KfUa&f4hOmbJEP zm#uxjE_>azy0LY8>dopG)xTPwvHtRgzzt0s%{NwWe7i}s>E`C}&CLz=4K-UBTZ*^* zx;1rc$JahzH*Pc8R=w@7?c(j7I}&%CZ1iqy+-bIR=`M1YY*)|jiMua;6Y@<$ZWrHvcV{kq*jL@tx>s}G z?0&;PhW%qtr&s6U2O$s6{hajkori*lPkt%<<$c%uUp0QMd1U#hvD>5jP)}IT#m5sK zcRi6jdDmO{oAz(@PaU6r_j};)=laI?bv=_l`}oJ==f=;s|2gu{_80Ll?!U}``R-NK lYvb2D-uS%fcsuUxqjxjjGvC+#HSDjp4^bcPe$4;)@t=LG`q%&f literal 0 HcmV?d00001 diff --git a/test/fixtures/strip_location_gps_grid.heic b/test/fixtures/strip_location_gps_grid.heic new file mode 100644 index 0000000000000000000000000000000000000000..3a9d5bf97b904a1c99af9cf1bf88f71ce18ea9eb GIT binary patch literal 12530 zcmeHMcU)A*x1YQBZUL5EdM``wu%IY*dJzyrED)ovTVP>X)}@GOY%y4457yXX*QhbE z#)4g=v6mzoe;8vFH3`O8q9(pGcXkny`+4vEO5Pvu!@%8h&Uf0GGiT17J&O?X*Hn%& z6sxsL1f@)?iO$yM8q2f_O|~{Yk>DQkGIgZ_*F*6sR_Tm{MaZC4R+@P;^;c>28W22G zMm46mQ1FPWj5?W#ml(8_Wxyj8jSv&8B|Q*|0mKmmH4pcJUd7c)Xwe#kn!kcH7szmd zd@fMH1q!)95f^B|1zK`}R$QQ%3$*3}C0wAC3$)<^ZMi@@F3_F}bl?IVxj-i_(3uN# z;R0Q`KsPSXoeT8f0zJ7vFD}rV3zTtzK3t$L7wE?Y`g4H+Twov<7{mnzbAcgTU?>+D z#s!9Rfe~C_Bo`RP1;6ZHuTq1i2sOYn3Y3NzOLa#`$H3jB7ZBBdYjalk*U)(+?cd^|!te?w(r9`L<^S5=kvPXHd=mbXP?OzjVR zPvE~Pu1d#zM}%mX+T#3yz(Y`>vr5Y|abGyNv_?O?PY&=f7d=H;kyHpg94Y#6u{s0q z85~*qzOg(Hw}Au1NL1?N6yQM*CQe(Kk#FMbDysWo9Q0%^*A^#XJz*}sxJ1!A7kD_( z{6MuX4bKbX@Usk+xp+*F`PF(|A3Rq)@F&$3?0P{Kh$@To(*chGKEKkKkNbi?f;x>h zH3Rrm;5QZ<(=iU~6*L=kte=5RgpmqkN*dr`6Jd?9Di7NM)+k)9*7wKu1RoLJL<1-V zQloM-96psuk8Z)~s6bj&&2mLZfy&^Kfd=95q(Lh^JVt0yfl2`{0{%`*J(h6~+$RDV zpspNgpsfyinsFIY!3d-$9;F-}Ea8#wu_G%@Ge*LUNnUGE71S4_hfrS(TsCTCks8pj z4CEw0tDvq3_|~(;fG5SETvl761FpxjG?`{8haM_+F47OLljxQNI_ps_)M4G&wKL9) zoaq2hHztee!N}R!jL>2fieT~XEM}hd&C2oGnp$QZ0lKzceQS%Et$YaVRS6^OV1;^< zeJVhkSD<&PsrMUevNO(hs|q$4>Sy-N7_t`hg_Tb<4%I5p&1ya|W}gd^U7gWz3duIx z>^aG<2U|vVh1os$lK8}!|7KU;?50__w!50s+HY7-QvJnmU@rbe{(1gQ{$(Ts`aS;& z{~mDH`8VM2>lS_9>;d*EE#Sl_h_@*znr(@_Faa#1V{6O68hEGF>^`MIKLyyg0<2dB zeuwuu0z9DgUbOWPJX-5|>=9)4A{duQZ#-VfBG^Ol{McLmYM+1RgtR&z8vSfHgJH

?Sm$U%eToN%2&%b%OA^cvQ}XCPkv4Qqx_0|CDc5i=g~Xp{q!Ds zFMS5dK-xnF!nXY1Y1G=*Z6gTTefE?}{3Ov5p(IoiD@l-05+C@Bk;DV%C-IeJ zNt~fJT@oZombkar!@OfUK(Gg4&wJyGB<>Y}mS#`G>nn!cH?mPqVOsB>*C=bVN*n>T zt9HG!pbMf?aWR&_nEzwP}N6H;!81@zh)F9&-4o zpsOHAkRk|zz9d@71j&MQK`N37qA@Or67&YX3vR`DG0{v0M7y3NZ1|z za2zByieP#{ZBHhdiNi6n^=d&AVp|+7xmViy6vADjQe6Z06@-$?4Wo?OqT)(f0^E$$ zvJAa4GF%oTkA^oQzGvY!2tDr0-k&I^Gs-GsHNhB6_;4?j!adLx?tOmnR*wK(JELy! zo=t&!Lk`ME1!xFpR}6b;1lx{56HpzRj%K3|&|xjEbS+sGd{`l||)I1=KLAh|*J4)EMerYC1KS zT1>5^Hc+2Xd#FRyDe40CHFb+>qJE)X@MxZx=fLyi1@fYJal8axCNH1&Hm`^`f>+C% z#GA=m$XmtR%-hL3#5>Kq!fWI`;60%cZAClLK6C^fM<>xabRn&wjr3T08eLDXqPIX4 zI6+^c8|jDiZ;XJkXJkwS>`gk;pHVU+n6b6QNM( zDhw0$5atLK!b)MCaFKAc@SyOb@Q(1g$V%ibiV>xX3PpO+L{YtHqv(L>qUf&ZrGCXGY-MHTYt_Z7 zua(wnywyUhZB{3(Zdv^%wiAbnlf;9?RpOcAb>ar`*W$<4*4Ba6@z#abmDV$@H&`FB zzG?kjVlRo5WJpw!agrsHosx@^pQIMj0BM4Bh_qH(Fa1<{PWsTs!Y0rr$wpx_)@F&# z9-C`6Pi*aNqiu6+%WP-ZZnQmRd(Td27igDar?Q)5_mSNZyW94(y`O!Oz0&?&`_=Zx z?C&@T9D*D&97-IfJACYL)}h(a&atE80LL1~C64o_VtM9jdmVR-5 z8o&8|hy9xUz5TQO$M|pZ|0cj9ATFRdU_ro%fM50dM=C?)+tOI_F>qCaDI4~aDDiy@M{s` zh=hphh)ofD&=_UR zl9-bfyeQb8@4&SoriT^+WA_X zLtJj$jJT6s_+1jajO((m%Wqvfb*=2Wz3b22BD$4!+t}@1_n_|T?yI}s?%~@*(PL$g z#-6gC!+Ngh+1Sgcm!j9IUf;$0#jE1i#@|f{NhnF!obXekJkglABk@^M*Q9rn8j|Vc zwB%{YXH)D_`ll>TxtZ#lT9mpewK**|ZFE{gIzK%#eNOtd49^T@#)gdM-kp2D)B9+q zII~~o;>_=|LbHrnd$W1jy|d?K-{=$2N8e{x4$8^MnV0izZcy%s+|T<8`sVgs()WkF z=)5s`C;Hj<8`^JUzo+?$`Lpt`_Ydx0)&KAS>43olHVk++FnQqIfsKQr2E8-rbb(ue zwqSRmuy8=(+QKJqrM&gQTXzP>4z3$~_3fayYu-LJ#BGRf$o`?yp^BlO4&x6SIBesv zSBf0PD#erG8N-(jZ&oHL7bqX7;#KoiP3j)%x$3)`9-6tDdqq8p<`p#+_bRS0eyB~- zF4jIONiSJm@~kwcbY1Cd-9X*eGEv#EvORh`eX0IvxmS5j`2|Cmq0Z1aqU(qcMl>5U zjcY5Yinl9vS31C#(lb@TRqs{Zs_t36r26^D0V6-Hv8~b9oEa55YU-%FwW+mhMl++8 zqYsbq88czbt#=aMSvi&(JACZnaem__jk_~GZT$KPmJ>=Rd^u4*aqh%l-yQhw-btR5 z#!tHaUfO$`>Lhi>x@(iWOCfDO*QR{>GJ9I(_hU{&iLZ}==T@C z|9Ylo=Gj@DW-Xg7n600EbxyB2>*w0et(|*&UiQ45^JVj=&Hwd-p&y*8?^wTlf#rg# z1&s@{7Vci;zi9TNSBr}mUs;m4Wb0CorBjza`%v}a#bxo!wk-EtK7IL%71|YFtxQ|F zb5-D~`i}%3Re$uu>H(`ytchE*VXfQR>1%&qr(f5&K5zZe4V^b^*yyow)+XMjs!dIs z2X8+Aaq`Ezw?u4Nxz%aw^lfNc)wcVe4EyBj_RQ^vKaKlz%VzQtMh372JAL?5Grg&uYQ0293d&a0xlrV@syZ){Ter*aSIy%7lvD`ggRLw+!NYXtYCO( ze8K6t$*ULG4->6|Mz+aRgW|g^hbCKF{|vk2Iic~8@+j6C$`mjeF42f$-krdkjCh35 zgfN8g2@wz?Bt%4r1tFG%SP>#7#F`KZAyPtY2(cx^ju3l790+kF#EB4RLR<)OCB%&o zcS1Y}@g&5H5N|?cg!mBRONbvK{)7Y&5=cl8A;E-%5E4pA7$M<=L=X~5NE9J*LZbN- zc#PmZu&s?&rGRbc3#AR%4QRPmSFWU>A{oJ@5i_tE2zk~3)e!Gt<(sSwdkqEZy`VYN zv$s!H-pI;)T#aRK8&(#y$oRUdfg~m_xc&w!V}E01St8I9NN}3v&A@2jT5FPh>{!{V zMJD=*TV$di{ImcC#`h)qNm^v0pVTb-5&iHd+ujfBR{{xDv)l-b2GXl0*&k9+Aj6Lb zP+)w2qMw6V4j}r$PX?qufanLm7MNtBAN){2XeF)J{)*@s5N|29P4#nv>4Ne?F zf$>APu(F?74kP;cx5z}lfEKwCI1Nq)LV^C_M8BXGndld6mLsr!C6J)T1=>g86s{g8 z5KZ!ZRt_`Ek%L${yhT3F%8pvT|gLyo!~h%(5Ksyq-;gv+d<$L9WD+2Pl4U z5y6ST1!NBu5WHrpj6FXXc31`<0+PYc&SrHLAwJ~>U&qK8y(#w=K935G$-8J!0*59egz>|#AIdJ#TZ z9Os3hzZt&|oOvEtiCI?)x5WkT4z9<$0#pH^>rZ)9^2N346?ixo--a%p7SL0Apn4eWet;A3hb`&X3neG z#8J~tj9{sWvB`y*+GhcCwOj0O^)U_hT-~a#Io4NhW zw4a&wGt+)%+P^ime*^sUH;w<~cjo`Q_e{y(mIJ7B^?p4`(AzoHGai4D65#AZ`)vP8 ZHl^K?|Eatbmn98kvQ=ZH_`(MK6F5dtE literal 0 HcmV?d00001 diff --git a/test/pleroma/upload/filter/exif/strip_location_test.exs b/test/pleroma/upload/filter/exif/strip_location_test.exs index 01ca37711..3291e7aa6 100644 --- a/test/pleroma/upload/filter/exif/strip_location_test.exs +++ b/test/pleroma/upload/filter/exif/strip_location_test.exs @@ -13,9 +13,11 @@ defmodule Pleroma.Upload.Filter.Exif.StripLocationTest do {"DSCN0010.jpg", "image/jpeg"}, {"DSCN0010.png", "image/png"}, {"strip_location_gps.webp", "image/webp"}, - {"strip_location_gps.heic", "image/heic"} + {"strip_location_gps.heic", "image/heic"}, + {"strip_location_gps_grid.heic", "image/heic"}, + {"strip_location_gps.tiff", "image/tiff"} ] do - test "strips GPS data from #{content_type}" do + test "strips GPS data from #{fixture} (#{content_type})" do upload = upload_copy(unquote(fixture), unquote(content_type)) assert gps_tags(upload.tempfile) =~ "GPS Latitude" @@ -40,6 +42,12 @@ defmodule Pleroma.Upload.Filter.Exif.StripLocationTest do assert File.read!(upload.tempfile) == original end + test "accepts PNG files with data after IEND" do + upload = upload_copy("image_with_stray_data_after.png", "image/png") + + assert {:ok, _} = StripLocation.filter(upload) + end + test "ignores non-image uploads" do upload = upload_copy("DSCN0010.jpg", "application/octet-stream")