Arch Linux

The workaround was supposed to be permanent as a security enhancement. This is recommendation from people who discovered dozens of ghostscript vulnerabilities. Modification of the 'workaround' was proposed here: https://bugs.archlinux.org/task/62171

If this is meant to be permanent, it should go upstream. I'm against permanently shipping a non-upstreamed patch, unless there is an actual, unfixed security issue.

We're talking about config, not patching the code. Upstream delegates configuration for downstream: https://imagemagick.org/script/security-policy.php

"ImageMagick best practices strongly encourages you to configure a security policy.xml that suits your local environment. The policy is open by default. This affords maximum utility for ImageMagick installations that run in a sandboxed environment, perhaps in a Docker instance, or behind a firewall where security risks are greatly diminished as opposed to a public website."

Feel free to remove modifications as you wish.

I don't know if this is related but I want to convert a PDF file (created for me with Libreoffice) to PNG but:

$ convert artículo\ prensa\ problema\ casero-EN.pdf artículo\ prensa\ problema\ casero-EN.png
convert: attempt to perform an operation not allowed by the security policy `PDF' @ error/constitute.c/IsCoderAuthorized/408.
convert: no images defined `artículo prensa problema casero-EN.png' @ error/convert.c/ConvertImageCommand/3273.

Why won't you let me convert my PDF to PNG? I understand that this would be denied if the PDF to be converted had some security limitation but doing so as a rule seems absurd to me.

I think we should patch the installed policy file in package(), then. It would make it more obvious this is a change to the default configuration and also obsolete the hack in check().

I second @j1simon. Convert is a common CLI tool and this affects user directly. So, IMHO, it outweighs the risk of avoiding an unknown exploit. Here it is clearly mentioned it has been resolved in Ghostscript version 9.24

https://www.kb.cert.org/vuls/id/332928/

@jadelord

There were multiple security issues past 9.24 release, please improve your research: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=ghostscript

I think this is a better solution: https://bugs.archlinux.org/task/62171