From 731ed07a25df4fc60c3bc464ab87de142849f746 Mon Sep 17 00:00:00 2001
From: tituspijean <titus+yunohost@pijean.ovh>
Date: Thu, 15 Feb 2024 18:19:54 +0000
Subject: [PATCH] Implement imagemagick policy for `convert` calls

---
 conf/policy.xml | 23 +++++++++++++++++++++++
 manifest.toml   |  2 +-
 scripts/install |  6 ++++++
 scripts/upgrade |  6 ++++++
 4 files changed, 36 insertions(+), 1 deletion(-)
 create mode 100644 conf/policy.xml

diff --git a/conf/policy.xml b/conf/policy.xml
new file mode 100644
index 0000000..35ec974
--- /dev/null
+++ b/conf/policy.xml
@@ -0,0 +1,23 @@
+<policymap>
+  <!-- temporary path must be a preexisting writable directory -->
+  <policy domain="resource" name="temporary-path" value="__DATA_DIR__/imagemagick"/>
+  <policy domain="resource" name="memory" value="256MiB"/>
+  <policy domain="resource" name="list-length" value="32"/>
+  <policy domain="resource" name="width" value="8KP"/>
+  <policy domain="resource" name="height" value="8KP"/>
+  <policy domain="resource" name="map" value="512MiB"/>
+  <policy domain="resource" name="area" value="16KP"/>
+  <policy domain="resource" name="disk" value="1GiB"/>
+  <policy domain="resource" name="file" value="768"/>
+  <policy domain="resource" name="thread" value="2"/>
+  <policy domain="resource" name="time" value="120"/>
+  <policy domain="module" rights="none" pattern="URL" />
+  <policy domain="coder" rights="read | write" pattern="{MSVG,MVG,PS,PDF,RSVG,SVG,XPS}" />
+  <policy domain="filter" rights="none" pattern="*" />
+  <policy domain="path" rights="none" pattern="-"/>  <!-- don't read/write from/to stdin/stdout -->
+  <policy domain="path" rights="none" pattern="/etc/*"/>  <!-- don't read sensitive paths -->
+  <policy domain="path" rights="none" pattern="@*"/>  <!-- indirect reads not permitted -->
+  <policy domain="cache" name="memory-map" value="anonymous"/>
+  <policy domain="cache" name="synchronize" value="true"/>
+  <policy domain="system" name="shred" value="1"/>
+</policymap>
diff --git a/manifest.toml b/manifest.toml
index fb8556e..3206098 100644
--- a/manifest.toml
+++ b/manifest.toml
@@ -70,7 +70,7 @@ ram.runtime = "350M"
     [resources.install_dir]
 
     [resources.data_dir]
-    subdirs = ["consume", "data", "media"]
+    subdirs = ["consume", "data", "media", "imagemagick"]
 
     [resources.permissions]
     main.url = "/"
diff --git a/scripts/install b/scripts/install
index 438bd16..f5f87df 100755
--- a/scripts/install
+++ b/scripts/install
@@ -103,6 +103,12 @@ ynh_add_config --template="paperless.conf.example" --destination="$install_dir/p
 chmod 400 "$install_dir/paperless.conf"
 chown $app:$app "$install_dir/paperless.conf"
 
+# ImageMagick configuration
+mkdir -p "$install_dir/.config/ImageMagick"
+ynh_add_config --template="policy.xml" --destination="$install_dir/.config/ImageMagick/policy.xml"
+chmod 400 "$install_dir/.config/ImageMagick/policy.xml"
+chown -R $app:$app "$install_dir/.config"
+
 #=================================================
 # SETUP THE DATABASE
 #=================================================
diff --git a/scripts/upgrade b/scripts/upgrade
index d10352d..6be9942 100644
--- a/scripts/upgrade
+++ b/scripts/upgrade
@@ -128,6 +128,12 @@ ynh_add_config --template="paperless.conf.example" --destination="$install_dir/p
 chmod 400 "$install_dir/paperless.conf"
 chown $app:$app "$install_dir/paperless.conf"
 
+# ImageMagick configuration
+mkdir -p "$install_dir/.config/ImageMagick"
+ynh_add_config --template="policy.xml" --destination="$install_dir/.config/ImageMagick/policy.xml"
+chmod 400 "$install_dir/.config/ImageMagick/policy.xml"
+chown -R $app:$app "$install_dir/.config"
+
 #=================================================
 # SETUP THE DATABASE
 #=================================================