Page MenuHomePhorge
Files F85831884

No OneTemporary
Actions

Authored By
Unknown
Size
4 KB
Referenced Files
None
Subscribers
None

View Options

diff --git a/changelog.d/exif-heic-gps.security b/changelog.d/exif-heic-gps.security
index 0ca439d0c..0b6593f5f 100644
--- a/changelog.d/exif-heic-gps.security
+++ b/changelog.d/exif-heic-gps.security
@@ -1 +1 @@
-Strip GPS data from WebP and HEIC/AVIF uploads; the Exiftool.StripLocation filter used to skip them
+Strip GPS data from WebP and HEIC/AVIF uploads; the Exiftool.StripLocation filter used to skip them; GPS data in XMP (including DJI drone positions) is stripped too
diff --git a/mix.exs b/mix.exs
index 6527f902b..6c2cfe9c9 100644
--- a/mix.exs
+++ b/mix.exs
@@ -205,7 +205,7 @@ defmodule Pleroma.Mixfile do
{:majic, "~> 1.2"},
{:open_api_spex, "~> 3.22"},
{:ecto_psql_extras, "~> 0.8"},
- {:exif_stripper, "~> 0.1.2"},
+ {:exif_stripper, "~> 0.1.3"},
{:vix, "~> 0.36"},
{:elixir_make, "~> 0.7.8", override: true},
{:blurhash, "~> 0.1.0", hex: :rinpatch_blurhash},
diff --git a/mix.lock b/mix.lock
index 4fbcc257f..8904e6aa6 100644
--- a/mix.lock
+++ b/mix.lock
@@ -47,7 +47,7 @@
"ex_doc": {:hex, :ex_doc, "0.38.2", "504d25eef296b4dec3b8e33e810bc8b5344d565998cd83914ffe1b8503737c02", [:mix], [{:earmark_parser, "~> 1.4.44", [hex: :earmark_parser, repo: "hexpm", optional: false]}, {:makeup_c, ">= 0.1.0", [hex: :makeup_c, repo: "hexpm", optional: true]}, {:makeup_elixir, "~> 0.14 or ~> 1.0", [hex: :makeup_elixir, repo: "hexpm", optional: false]}, {:makeup_erlang, "~> 0.1 or ~> 1.0", [hex: :makeup_erlang, repo: "hexpm", optional: false]}, {:makeup_html, ">= 0.1.0", [hex: :makeup_html, repo: "hexpm", optional: true]}], "hexpm", "732f2d972e42c116a70802f9898c51b54916e542cc50968ac6980512ec90f42b"},
"ex_machina": {:hex, :ex_machina, "2.8.0", "a0e847b5712065055ec3255840e2c78ef9366634d62390839d4880483be38abe", [:mix], [{:ecto, "~> 2.2 or ~> 3.0", [hex: :ecto, repo: "hexpm", optional: true]}, {:ecto_sql, "~> 3.0", [hex: :ecto_sql, repo: "hexpm", optional: true]}], "hexpm", "79fe1a9c64c0c1c1fab6c4fa5d871682cb90de5885320c187d117004627a7729"},
"ex_syslogger": {:hex, :ex_syslogger, "1.5.2", "72b6aa2d47a236e999171f2e1ec18698740f40af0bd02c8c650bf5f1fd1bac79", [:mix], [{:poison, ">= 1.5.0", [hex: :poison, repo: "hexpm", optional: true]}, {:syslog, "~> 1.1.0", [hex: :syslog, repo: "hexpm", optional: false]}], "hexpm", "ab9fab4136dbc62651ec6f16fa4842f10cf02ab4433fa3d0976c01be99398399"},
- "exif_stripper": {:hex, :exif_stripper, "0.1.2", "fa176be937201366545c8c93b5d89b6e2da1ee00534c3f1fb931402e03262755", [:mix], [], "hexpm", "5c524f7cc061826a6108b7b6f85d1d2481d0cff4ce0a678aaedd6edaa0d86dcb"},
+ "exif_stripper": {:hex, :exif_stripper, "0.1.3", "b3d89a623bb49c09fbe45fe5d4f1becee0ffe011bcade174c3bb91cdae59745e", [:mix], [], "hexpm", "e1ab26d766205ae54be57c19ec70d408b020f3c31855b49d53a55460de81c6e1"},
"exile": {:hex, :exile, "0.10.0", "b69e2d27a9af670b0f0a0898addca0eda78f6f5ba95ccfbc9bc6ccdd04925436", [:make, :mix], [{:elixir_make, "~> 0.6", [hex: :elixir_make, repo: "hexpm", optional: false]}], "hexpm", "c62ee8fee565b5ac4a898d0dcd58d2b04fb5eec1655af1ddcc9eb582c6732c33"},
"expo": {:hex, :expo, "0.5.1", "249e826a897cac48f591deba863b26c16682b43711dd15ee86b92f25eafd96d9", [:mix], [], "hexpm", "68a4233b0658a3d12ee00d27d37d856b1ba48607e7ce20fd376958d0ba6ce92b"},
"fast_html": {:hex, :fast_html, "2.5.0", "23578c1c1fa03db6a3786d78218b2d944df34b0fc3729e72de912f390913c80f", [:make, :mix], [{:elixir_make, "~> 0.4", [hex: :elixir_make, repo: "hexpm", optional: false]}, {:nimble_pool, "~> 1.1", [hex: :nimble_pool, repo: "hexpm", optional: false]}], "hexpm", "69eb46ed98a5d9cca1ccd4a5ac94ce5dd626fc29513fbaa0a16cd8b2da67ae3e"},
diff --git a/test/fixtures/dji_gps.jpg b/test/fixtures/dji_gps.jpg
new file mode 100644
index 000000000..7249228cf
Binary files /dev/null and b/test/fixtures/dji_gps.jpg differ
diff --git a/test/fixtures/xmp_gps.jpg b/test/fixtures/xmp_gps.jpg
new file mode 100644
index 000000000..dd76e84f7
Binary files /dev/null and b/test/fixtures/xmp_gps.jpg differ
diff --git a/test/pleroma/upload/filter/exif/strip_location_test.exs b/test/pleroma/upload/filter/exif/strip_location_test.exs
index 3291e7aa6..f1bb3b87c 100644
--- a/test/pleroma/upload/filter/exif/strip_location_test.exs
+++ b/test/pleroma/upload/filter/exif/strip_location_test.exs
@@ -26,6 +26,21 @@ defmodule Pleroma.Upload.Filter.Exif.StripLocationTest do
end
end
+ test "strips GPS data from XMP, including DJI drone positions" do
+ for fixture <- ["xmp_gps.jpg", "dji_gps.jpg"] do
+ upload = upload_copy(fixture, "image/jpeg")
+ assert exiftool_xmp(upload.tempfile) =~ "GPSLatitude"
+
+ assert StripLocation.filter(upload) == {:ok, :filtered}
+ refute exiftool_xmp(upload.tempfile) =~ ~r/GPS|AbsoluteAltitude/
+ end
+ end
+
+ defp exiftool_xmp(path) do
+ {output, 0} = System.cmd("exiftool", ["-m", "-s", "-xmp:all", path])
+ output
+ end
+
test "keeps other EXIF data in HEIC" do
upload = upload_copy("strip_location_gps.heic", "image/heic")

File Metadata

Mime Type
text/x-diff
Expires
Sun, Nov 1, 11:49 PM (13 h, 28 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
1803428
Default Alt Text
(4 KB)

Event Timeline