-
Notifications
You must be signed in to change notification settings - Fork 612
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
security: change command line embedding for oiiotool & maketx output #4237
Changes from 1 commit
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
It was pointed out that oiiotool and maketx's habit of embedding their exact command line arguments in the Software and ImageHistory metadata of output images was potentially problematic in that it might inadvertently leak important internal data (for example, file paths may reveal secret projects, etc.). This patch changes the behavior of oiiotool and maketx as follows: * The default behavior is now to use `"OpenImageIO <version> <hash>"` where `<hash>` is the SHA-1 hash of the command line arguments (which allows you to tell if two files use the same command line args, but doesn't let you know what they were). * A new `--history` argument (or setting OIIOTOOL_METADATA_HISTORY env variable to a nonzero integer) instead uses the full command line arguments with no obfuscation. (This used to be the default behavior but is now deemed unsafe.) When the env variable is in effect, a `--no-history` argument explicitly disables it. * For oiiotool, the existing `--nosoftwareattrib`, as before, causes the Software and ImageHistory metadata to not be modified at all. Here is an example of the behavior: ``` $ oiiotool tmp.tif -o tmp.exr && iinfo -v tmp.exr tmp.exr : 640 x 480, 3 channel, half openexr channel list: R, G, B Software: "OpenImageIO 2.6.2.0dev : B897973B86EC13E3F1858AAE5E057EFCCF99889A" ... $ oiiotool --history tmp.tif -o tmp.exr && iinfo -v tmp.exr tmp.exr : 640 x 480, 3 channel, half openexr channel list: R, G, B Software: "OpenImageIO 2.6.2.0dev : oiiotool --history tmp.tif -o tmp.exr" Exif:ImageHistory: "oiiotool --history tmp.tif -o tmp.exr" ... ``` Signed-off-by: Larry Gritz <lg@larrygritz.com>
- Loading branch information
There are no files selected for viewing
Original file line number | Diff line number | Diff line change | ||||||||
---|---|---|---|---|---|---|---|---|---|---|
|
@@ -1952,10 +1952,33 @@ current top image. | |||||||||
are not set, only the first subimage will be changed, or all subimages | ||||||||||
if the `-a` command line flag was used. | ||||||||||
|
||||||||||
.. option:: --nosoftwareattrib | ||||||||||
.. option:: --history | ||||||||||
--no-history | ||||||||||
--nosoftwareattrib | ||||||||||
|
||||||||||
When set, this prevents the normal adjustment of "Software" and | ||||||||||
"ImageHistory" metadata to reflect what :program:`oiiotool` is doing. | ||||||||||
By default, oiiotool writes "OpenImageIO <version>" and a SHA-1 hash of | ||||||||||
the command line as the "Software" metadata in output images. | ||||||||||
|
||||||||||
The `--history` option appends the full command line arguments and appends | ||||||||||
that information to the "ImageHistory" metadata as well. This behavior is | ||||||||||
"opt-in" because some users may find it undesirable for metadata in the | ||||||||||
image to potentially reveal any proprietary information that might have | ||||||||||
been present in the command line arguments. | ||||||||||
|
||||||||||
If the `OIIOTOOL_METADATA_HISTORY` environment variable is set to a | ||||||||||
nonzero integer value, the `--history` option will be enabled by default, | ||||||||||
but can be disabled on the command line with `--no-history`. | ||||||||||
|
||||||||||
The `--nosoftwareattrib` option prevents even the minimal default information | ||||||||||
from being written, so that no information about the software is written | ||||||||||
to any metadata field. | ||||||||||
|
||||||||||
Prior to OpenImageIO 2.5.11, the full information was always written, but | ||||||||||
could be overridden with `--nosoftwareattrib`. Beginning with 2.5.11, the | ||||||||||
default changed only say the software name and version (unless the | ||||||||||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
Suggested change
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. or since "saved" is used later in the sentence in a different way and so could be confusing:
Suggested change
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. that's awkward, I will reword a bit |
||||||||||
`OIIOTOOL_METADATA_HISTORY` environment variable is set), and require the | ||||||||||
new `--history` option to cause the command line arguments to be saved as | ||||||||||
meetadata. | ||||||||||
|
||||||||||
.. option:: --sansattrib | ||||||||||
|
||||||||||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Should it be this?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I was assuming people would want this backported to the next monthly patch of the release branch.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
So then should it be 2.5.11?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Sorry, I answered that too fast. It shouldn't read 2.5.0 either. It will end up being 2.5.11.