Skip to content

Commit 132f9ff

Browse files
sunupantierra
authored andcommitted
Skip GDAL VRT driver to mitigate security issue
Skip VRT driver to prevent arbitrary file reading vulnerability reported in GDAL issue OSGeo/gdal#12645 and developmentseed/titiler#1180. This configuration prevents exploitation of GDAL's VRT driver which can be used to read arbitrary files from the filesystem.
1 parent 2d79755 commit 132f9ff

File tree

1 file changed

+1
-0
lines changed

1 file changed

+1
-0
lines changed

charts/eoapi/values.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -295,6 +295,7 @@ raster:
295295
GDAL_HTTP_MERGE_CONSECUTIVE_RANGES: "YES"
296296
GDAL_HTTP_MULTIPLEX: "YES"
297297
GDAL_HTTP_VERSION: "2"
298+
GDAL_SKIP: "VRT" # skip VRT driver to avoid https://github.com/OSGeo/gdal/issues/12645
298299
PYTHONWARNINGS: "ignore"
299300
VSI_CACHE: "TRUE"
300301
VSI_CACHE_SIZE: "5000000" # 5 MB (per file-handle)

0 commit comments

Comments
 (0)