Skip to content

Commit f0d9011

Browse files
authored
Add suggestion to images.md
1 parent c7c6266 commit f0d9011

File tree

1 file changed

+8
-5
lines changed

1 file changed

+8
-5
lines changed

docs/content_management/images/images.md

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -59,11 +59,14 @@ LiipImagineBundle only works on image blobs, so no command line tool is needed.
5959

6060
For more information, see the [bundle's documentation](https://symfony.com/bundles/LiipImagineBundle/current/configuration.html).
6161

62-
!!! caution "Code injection in image EXIF"
63-
64-
EXIF metadata of an image may contain for example, HTML, JavaScript, or PHP code. 
65-
[[= product_name =]] itself doesn't parse EXIF metadata, but third-party bundles must be secured against this eventuality.
66-
Images must be treated like any other user-submitted data - make sure that metadata is properly escaped before use.
62+
!!! caution "Code injection in images"
63+
64+
Images must be treated like any other user-submitted data - as potentially malicious.
65+
- EXIF metadata of an image may contain for example, HTML, JavaScript, or PHP code.
66+
[[= product_name =]] itself doesn't parse EXIF metadata, but third-party bundles must be secured against this eventuality.
67+
Make sure that metadata is properly escaped before use.
68+
- Images may contain specially crafted flaws that exploit vulnerabilities in common image libraries
69+
like GD or Imagick, leading to code execution. It's important to keep these libraries up to date with security updates.
6770

6871
### Image URL resolution
6972

0 commit comments

Comments
 (0)