File tree Expand file tree Collapse file tree 1 file changed +8
-5
lines changed
docs/content_management/images Expand file tree Collapse file tree 1 file changed +8
-5
lines changed Original file line number Diff line number Diff line change @@ -59,11 +59,14 @@ LiipImagineBundle only works on image blobs, so no command line tool is needed.
5959
6060For more information, see the [ bundle's documentation] ( https://symfony.com/bundles/LiipImagineBundle/current/configuration.html ) .
6161
62- !!! caution "Code injection in image EXIF"
63-
64- EXIF metadata of an image may contain for example, HTML, JavaScript, or PHP code.
65- [[= product_name =]] itself doesn't parse EXIF metadata, but third-party bundles must be secured against this eventuality.
66- Images must be treated like any other user-submitted data - make sure that metadata is properly escaped before use.
62+ !!! caution "Code injection in images"
63+
64+ Images must be treated like any other user-submitted data - as potentially malicious.
65+ - EXIF metadata of an image may contain for example, HTML, JavaScript, or PHP code.
66+ [[= product_name =]] itself doesn't parse EXIF metadata, but third-party bundles must be secured against this eventuality.
67+ Make sure that metadata is properly escaped before use.
68+ - Images may contain specially crafted flaws that exploit vulnerabilities in common image libraries
69+ like GD or Imagick, leading to code execution. It's important to keep these libraries up to date with security updates.
6770
6871### Image URL resolution
6972
You can’t perform that action at this time.
0 commit comments