Skip to content

Instantly share code, notes, and snippets.

@directionless
Last active September 11, 2021 13:15
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save directionless/3678187eff3c0ea0f1e3bc4488da0113 to your computer and use it in GitHub Desktop.
Save directionless/3678187eff3c0ea0f1e3bc4488da0113 to your computer and use it in GitHub Desktop.
ImageMagick policy.xml for blocking various exploits
<!-- This is my imagemagick policy.xml file. It's a collection of various
recommendations cargo culted from around the internet to block various
exploits. It is effective in stopping CVE-2021-3781 (https://twitter.com/ducnt_/status/1434534373416574983
and https://github.com/duc-nt/RCE-0-day-for-GhostScript-9.50) -->
<policymap>
<policy domain="cache" name="shared-secret" value="passphrase" stealth="true"/>
<policy domain="coder" rights="none" pattern="EPHEMERAL" />
<policy domain="coder" rights="none" pattern="EPI" />
<policy domain="coder" rights="none" pattern="EPS" />
<policy domain="coder" rights="none" pattern="MSL" />
<policy domain="coder" rights="none" pattern="MVG" />
<policy domain="coder" rights="none" pattern="PDF" />
<policy domain="coder" rights="none" pattern="PLT" />
<policy domain="coder" rights="none" pattern="PS" />
<policy domain="coder" rights="none" pattern="PS2" />
<policy domain="coder" rights="none" pattern="PS3" />
<policy domain="coder" rights="none" pattern="SHOW" />
<policy domain="coder" rights="none" pattern="TEXT" />
<policy domain="coder" rights="none" pattern="WIN" />
<policy domain="coder" rights="none" pattern="XPS" />
<policy domain="delegate" rights="none" pattern="HTTP" />
<policy domain="delegate" rights="none" pattern="HTTPS" />
<policy domain="delegate" rights="none" pattern="URL" />
<policy domain="path" rights="none" pattern="@*"/>
<policy domain="resource" name="area" value="128MB"/>
<policy domain="resource" name="disk" value="1GiB"/>
<policy domain="resource" name="height" value="16KP"/>
<policy domain="resource" name="map" value="512MiB"/>
<policy domain="resource" name="memory" value="256MiB"/>
<policy domain="resource" name="width" value="16KP"/>
</policymap>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment