GraphicsMagick and ImageMagick popen() shell vulnerability via filename

Re:GraphicsMagick and ImageMagick popen() shell vulnerabilit... by cyphar on Monday May 30, 2016 @01:22AM (#11799705)

> From a security standpoint, wouldn't it be better to rely on PHP (first)?

You're joking, right? Popping PHP boxes is script kiddie 101. You might argue that "bad developers make insecure software" but when you're given a toolbox with nothing but oddly shaped hammers it's very hard to make a house.

[ Parent | on HN ]

Re:GraphicsMagick and ImageMagick popen() shell vulnerabilit... by lillesvin on Monday May 30, 2016 @05:13AM (#11800391)

That's rarely PHP failing but whatever framework/CMS is used. That's like saying C++ is inherently insecure because there exists a lot of software written in C++ with security holes.

[ Parent | on HN ]

Re:GraphicsMagick and ImageMagick popen() shell vulnerabilit... by cyphar on Monday May 30, 2016 @01:14PM (#11802171)

Did you read the second sentence I wrote? Just because you can write safe code in a language that tries to make you footgun at every turn, doesn't mean that language is a good language. Pick a language that doesn't suffer from crippling security issues (which, sure, you can workaround -- but why use a language that requires workarounds to get security?).

[ Parent | on HN ]

Re:GraphicsMagick and ImageMagick popen() shell vulnerabilit... by ndj7 on Friday June 03, 2016 @04:47PM (#11833164)

We started Imageflow (https://www.imageflow.io ) in C to design the C ABI for interop with all the host languages, but we're swapping out components for Rust every time it's possible/practical.

[ Parent | on HN ]