ImageMagick-mirror/config/policy-open.xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE policymap [
  <!ELEMENT policymap (policy)*>
  <!ATTLIST policymap xmlns CDATA #FIXED "">

  <!ELEMENT policy EMPTY>
  <!ATTLIST policy
    xmlns   CDATA   #FIXED ""
    domain  NMTOKEN #REQUIRED
    name    NMTOKEN #IMPLIED
    pattern CDATA   #IMPLIED
    rights  NMTOKEN #IMPLIED
    stealth NMTOKEN #IMPLIED
    value   CDATA   #IMPLIED
  >
]>

<!--
  ImageMagick Security Policy Configuration
  ========================================

  This file provides the default "open" ImageMagick security policy along with
  numerous optional hardening examples. The default configuration permits broad
  functionality and is appropriate only for trusted environments such as
  systems protected by firewalls, isolated containers, or tightly controlled
  internal workloads.

  For untrusted input or multi-tenant environments, review and customize this
  policy to match your security requirements.

  Additional documentation:
    https://imagemagick.org/script/security-policy.php

  Security policy validator:
    https://imagemagick-secevaluator.doyensec.com/

  Important:
    * Security policies should be reviewed for your specific deployment.
    * Test all policy changes to confirm they behave as expected.
    * Rules are processed in order.
    * Policy names, domains, and patterns are case-sensitive.

  Domains:
    system, resource, cache, delegate, filter, module, path, and coder

  Rights:
    none, read, write, execute, all

  Multiple rights may be combined:
    rights="read|write"

  Patterns use ImageMagick glob matching.

  Example: disable all video modules

    <policy domain="module" rights="none" pattern="VIDEO"/>

  Example: disable HTTP image reads

    <policy domain="coder" rights="none" pattern="HTTP"/>

  Example: permit read-only access to a repository

    <policy domain="path" rights="read"
      pattern="/repository/*"/>

  Example: disable all image filters

    <policy domain="filter" rights="none" pattern="*"/>

  Example: restrict processing to common web-safe formats

    <policy domain="delegate" rights="none" pattern="*"/>
    <policy domain="filter" rights="none" pattern="*"/>
    <policy domain="coder" rights="none" pattern="*"/>
    <policy domain="coder" rights="read|write"
      pattern="{GIF,JPEG,PNG,WEBP}"/>
-->

<policymap>

  <!-- Deny use of undefined domains. -->
  <policy domain="Undefined" rights="none"/>

  <!-- ================================================================== -->
  <!-- Resource Policies                                                   -->
  <!-- ================================================================== -->

  <!-- Maximum number of worker threads. -->
  <!-- <policy domain="resource" name="thread" value="2"/> -->

  <!-- Maximum execution time before processing is aborted. -->
  <!-- <policy domain="resource" name="time" value="120"/> -->

  <!-- Maximum number of open pixel cache files. -->
  <!-- <policy domain="resource" name="file" value="768"/> -->

  <!-- Maximum heap memory available to the pixel cache. -->
  <!-- <policy domain="resource" name="memory" value="256MiB"/> -->

  <!-- Maximum memory-mapped cache allocation. -->
  <!-- <policy domain="resource" name="map" value="512MiB"/> -->

  <!-- Maximum image area (width × height) cached in memory. -->
  <!-- <policy domain="resource" name="area" value="16KP"/> -->

  <!-- Maximum disk space available to the pixel cache. -->
  <!-- <policy domain="resource" name="disk" value="1GiB"/> -->

  <!-- Maximum number of images permitted in a sequence. -->
  <!-- <policy domain="resource" name="list-length" value="32"/> -->

  <!-- Maximum image width. -->
  <!-- <policy domain="resource" name="width" value="8KP"/> -->

  <!-- Maximum image height. -->
  <!-- <policy domain="resource" name="height" value="8KP"/> -->

  <!-- Yield the CPU periodically (milliseconds). -->
  <!-- <policy domain="resource" name="throttle" value="2"/> -->

  <!-- Use a private directory for ImageMagick temporary files. -->
  <!-- <policy domain="resource" name="temporary-path"
             value="/magick/tmp/"/> -->

  <!-- ================================================================== -->
  <!-- Pixel Cache Policies                                                -->
  <!-- ================================================================== -->

  <!-- Use anonymous memory mapping to initialize cache memory. -->
  <!-- <policy domain="cache" name="memory-map"
             value="anonymous"/> -->

  <!-- Force cache data to be flushed and synchronized to disk. -->
  <!-- <policy domain="cache" name="synchronize"
             value="true"/> -->

  <!-- Shared secret for distributed pixel cache clients. -->
  <!-- <policy domain="cache" name="shared-secret"
             value="secret-passphrase" stealth="true"/> -->

  <!-- Maximum authenticated distributed pixel cache clients. -->
  <!-- <policy domain="cache" name="max-dpc-clients"
             value="128"/> -->

  <!-- Maximum unauthenticated distributed pixel cache clients. -->
  <!-- <policy domain="cache"
             name="max-dpc-unauthenticated-clients"
             value="16"/> -->

  <!-- ================================================================== -->
  <!-- Delegate and Filter Policies                                        -->
  <!-- ================================================================== -->

  <!-- Disable execution of all delegates. -->
  <!-- <policy domain="delegate" rights="none" pattern="*"/> -->

  <!-- Disable loading of all image filters. -->
  <!-- <policy domain="filter" rights="none" pattern="*"/> -->

  <!-- ================================================================== -->
  <!-- Path Restrictions                                                   -->
  <!-- ================================================================== -->

  <!-- Disallow stdin and stdout image I/O. -->
  <!-- <policy domain="path" rights="none" pattern="-"/> -->

  <!-- Prevent access to sensitive system locations. -->
  <!-- <policy domain="path" rights="none" pattern="/etc/*"/> -->

  <!-- Disable indirect file reads (@filename). -->
  <!-- <policy domain="path" rights="none" pattern="@*"/> -->

  <!-- Disable pipe execution. -->
  <!-- <policy domain="path" rights="none" pattern="|*"/> -->

  <!-- ================================================================== -->
  <!-- Module Restrictions                                                 -->
  <!-- ================================================================== -->

  <!--
    Disable reading of higher-risk formats while still permitting writes.

    Common candidates include:
      MSL, MVG, PDF, PS, SVG, TXT, URL, and XPS

    Review carefully before enabling.
  -->
  <!-- <policy domain="module" rights="write"
             pattern="{MSL,MVG,PDF,PS,SVG,TXT,URL,XPS}"/> -->

  <!-- ================================================================== -->
  <!-- System Policies                                                     -->
  <!-- ================================================================== -->

  <!-- Overwrite temporary data before release or deletion. -->
  <!-- <policy domain="system" name="shred" value="1"/> -->

  <!-- Initialize newly allocated memory with zeros. -->
  <!-- <policy domain="system" name="memory-map"
             value="anonymous"/> -->

  <!-- Maximum permitted single memory allocation request. -->
  <!-- <policy domain="system" name="max-memory-request"
             value="256MiB"/> -->

  <!-- Refuse paths whose basename is a symbolic link. -->
  <!-- <policy domain="system"
             name="symlink"
             rights="none"
             pattern="follow"/> -->

  <!-- Disable SVG entity substitution. -->
  <!-- <policy domain="system"
             name="svg"
             rights="none"
             pattern="substitute-entities"/> -->

</policymap>