Add strict image validation #17458

Koc · 2016-01-20T16:32:48Z

Q	A
Bug fix?	yes (current validator does not validates corrupted images)
New feature?	yes
BC breaks?	no
Deprecations?	no
Tests pass?	not, but fail looks like not relates to this PR
Fixed tickets	-
License	MIT
Doc PR	-

getimagesize returns correct size for corrupted images, so I've added another check

xabbuh · 2016-01-20T21:17:13Z

src/Symfony/Component/Validator/Constraints/ImageValidator.php

@@ -43,6 +44,22 @@ public function validate($value, Constraint $constraint)
            return;
        }

+        if ($constraint->strict) {
+            if (!function_exists('imagecreatefromstring')) {
+                throw new RuntimeException('Strict image validation requires installed and enabled GD extension');


I think the error should be triggered when the constraint is configured not when the validation happens.

same logis uses in email validator: https://github.com/symfony/symfony/blob/master/src/Symfony/Component/Validator/Constraints/EmailValidator.php#L57

Imo we should then change that in the EmailValidator too (if there isn't a reason for doing it this way that I am missing).

Don't know, but is constraints can be cached and serialized? If yes and constructor wouldn't called then we will miss this check sometimes ang get fatal error in constraint validator.

dunglas · 2016-01-21T10:17:44Z

👍 great addition

fabpot · 2016-01-25T10:53:19Z

src/Symfony/Component/Validator/Constraints/Image.php

@@ -61,6 +61,7 @@ class Image extends File
    public $allowSquare = true;
    public $allowLandscape = true;
    public $allowPortrait = true;
+    public $strict = false;


I don't like strict here as it does not convey what it really does.

Can you suggest other name?

checkIfCorrupted
allowCorrupted
detectCorrupted
allowUnsupported
detectUnsupported
checkUnsupported or checkIfUnsupported

An image resource will be returned on success. FALSE is returned if the image type is unsupported, the data is not in a recognised format, or the image is corrupt and cannot be loaded.
http://php.net/manual/en/function.imagecreatefromstring.php

Koc · 2016-03-02T15:03:31Z

@fabpot strict renamed to detectCorrupted. Added new error message and code. Travis is green except php7 branch - twig bridge failures

jjsaunier · 2016-03-02T17:53:53Z

May be we should add a note on this feature in the docs about memory issue? Because default configuration of php is not fit to open HD image in memory via imagecreatefromstringand that will trigger a Fatal error: Allowed memory size

nicolas-grekas · 2016-03-04T11:26:44Z

I think we could accept this PR if the new constraint is disabled by default, and also if the check is done after getimagesize validation

xabbuh · 2016-03-06T08:57:57Z

I agree with @nicolas-grekas.

Koc · 2016-03-15T12:58:17Z

Are there any things that should to be done which blocks PR merging? @symfony/mergers

Koc · 2016-03-29T23:19:13Z

@fabpot I've added imagedestroy call and test for valid image. Travis is green.

HeahDude · 2016-03-30T18:21:11Z

Thanks for that PR!

nicolas-grekas · 2016-03-30T19:49:56Z

src/Symfony/Component/Validator/Constraints/Image.php

@@ -74,4 +77,5 @@ class Image extends File
    public $allowSquareMessage = 'The image is square ({{ width }}x{{ height }}px). Square images are not allowed.';
    public $allowLandscapeMessage = 'The image is landscape oriented ({{ width }}x{{ height }}px). Landscape oriented images are not allowed.';
    public $allowPortraitMessage = 'The image is portrait oriented ({{ width }}x{{ height }}px). Portrait oriented images are not allowed.';
+    public $corruptedMessage = 'This file contains corrupted image.';


I suggest The image file is corrupted.

nicolas-grekas · 2016-03-30T19:50:26Z

@Koc please move corruption check after image size validation.

Koc · 2016-03-30T20:42:39Z

@nicolas-grekas done. Travis failure looks unrelated

nicolas-grekas · 2016-03-30T21:17:06Z

src/Symfony/Component/Validator/Constraints/ImageValidator.php

+
+        if ($constraint->detectCorrupted) {
+            if (!function_exists('imagecreatefromstring')) {
+                throw new RuntimeException('Strict image validation requires installed and enabled GD extension');


Corrupted images detection requires... ?

nicolas-grekas · 2016-03-30T21:17:30Z

👍 with one minor comment

fabpot · 2016-03-31T07:41:28Z

Thank you @Koc.

This PR was merged into the 3.1-dev branch. Discussion ---------- Add strict image validation | Q | A | ------------- | --- | Bug fix? | yes (current validator does not validates corrupted images) | New feature? | yes | BC breaks? | no | Deprecations? | no | Tests pass? | not, but fail looks like not relates to this PR | Fixed tickets | - | License | MIT | Doc PR | - getimagesize returns correct size for corrupted images, so I've added another check Commits ------- 7b6a96e Add corrupted images validation

…ions (javiereguiluz) This PR was squashed before being merged into the master branch (closes #6433). Discussion ---------- Documented the detectCorrupted and corruptedMessage options | Q | A | ------------- | --- | Doc fix? | no | New docs? | yes | Applies to | master (3.1+) | Fixed tickets | symfony/symfony#17458 Commits ------- 2140822 Documented the detectCorrupted and corruptedMessage options

carsonbot added the Status: Needs Review label Jan 20, 2016

Koc force-pushed the strict-image-validator branch from c4a0e11 to 1d3a0d3 Compare January 20, 2016 16:36

xabbuh reviewed Jan 20, 2016
View reviewed changes

xabbuh added the Validator label Jan 20, 2016

fabpot reviewed Jan 25, 2016
View reviewed changes

Koc force-pushed the strict-image-validator branch 2 times, most recently from d16b576 to c46441f Compare March 2, 2016 14:49

javiereguiluz added Bug Feature labels Mar 3, 2016

javiereguiluz mentioned this pull request Mar 7, 2016

Autolabel new Pull Requests symfony-tools/carsonbot#29

Closed

Koc force-pushed the strict-image-validator branch from c46441f to 0405ac6 Compare March 29, 2016 23:12

nicolas-grekas reviewed Mar 30, 2016
View reviewed changes

Koc force-pushed the strict-image-validator branch 2 times, most recently from 62b1a3e to a298f22 Compare March 30, 2016 20:35

nicolas-grekas reviewed Mar 30, 2016
View reviewed changes

Add corrupted images validation

7b6a96e

Koc force-pushed the strict-image-validator branch from a298f22 to 7b6a96e Compare March 30, 2016 21:27

fabpot merged commit 7b6a96e into symfony:master Mar 31, 2016

javiereguiluz mentioned this pull request Apr 5, 2016

Documented the detectCorrupted and corruptedMessage options symfony/symfony-docs#6433

Closed

fabpot mentioned this pull request May 13, 2016

Release v3.1.0-BETA1 #18776

Merged

Koc deleted the strict-image-validator branch September 21, 2016 16:01

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add strict image validation #17458

Add strict image validation #17458

Koc commented Jan 20, 2016

xabbuh Jan 20, 2016

Koc Jan 20, 2016

xabbuh Jan 21, 2016

Koc Jan 21, 2016

dunglas commented Jan 21, 2016

fabpot Jan 25, 2016

Koc Jan 25, 2016

SofHad Jan 27, 2016

Koc commented Mar 2, 2016

jjsaunier commented Mar 2, 2016

nicolas-grekas commented Mar 4, 2016

xabbuh commented Mar 6, 2016

Koc commented Mar 15, 2016

Koc commented Mar 29, 2016

HeahDude commented Mar 30, 2016

nicolas-grekas Mar 30, 2016

nicolas-grekas commented Mar 30, 2016

Koc commented Mar 30, 2016

nicolas-grekas Mar 30, 2016

nicolas-grekas commented Mar 30, 2016

fabpot commented Mar 31, 2016

Add strict image validation #17458

Add strict image validation #17458

Conversation

Koc commented Jan 20, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

dunglas commented Jan 21, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Koc commented Mar 2, 2016

jjsaunier commented Mar 2, 2016

nicolas-grekas commented Mar 4, 2016

xabbuh commented Mar 6, 2016

Koc commented Mar 15, 2016

Koc commented Mar 29, 2016

HeahDude commented Mar 30, 2016

Choose a reason for hiding this comment

nicolas-grekas commented Mar 30, 2016

Koc commented Mar 30, 2016

Choose a reason for hiding this comment

nicolas-grekas commented Mar 30, 2016

fabpot commented Mar 31, 2016