Skip to content

Commit 87c44bc

Browse files
committed
Images: Update caution block (#2607)
(cherry picked from commit f6f99d7)
1 parent ac94a99 commit 87c44bc

File tree

1 file changed

+8
-4
lines changed

1 file changed

+8
-4
lines changed

docs/content_management/images/images.md

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -59,11 +59,15 @@ LiipImagineBundle only works on image blobs, so no command line tool is needed.
5959

6060
For more information, see the [bundle's documentation](https://symfony.com/bundles/LiipImagineBundle/current/configuration.html).
6161

62-
!!! caution "Code injection in image EXIF"
62+
!!! caution "Code injection in images"
6363

64-
EXIF metadata of an image may contain for example, HTML, JavaScript, or PHP code. 
65-
[[= product_name =]] is itself doesn't parse EXIF metadata, but third-party bundles must be secured against this eventuality.
66-
Images must be treated like any other user-submitted data - make sure that metadata is properly escaped before use.
64+
Images must be treated like any other user-submitted data - as potentially malicious.
65+
66+
- EXIF metadata of an image may contain for example, HTML, JavaScript, or PHP code.
67+
[[= product_name =]] itself doesn't parse EXIF metadata, but third-party bundles must be secured against this eventuality.
68+
Make sure that metadata is properly escaped before use.
69+
- Images may contain specially crafted flaws that exploit vulnerabilities in common image libraries
70+
like GD or Imagick, leading to code execution. It's important to keep these libraries up to date with security updates.
6771

6872
### Image URL resolution
6973

0 commit comments

Comments
 (0)