{"action":"created","issue":{"url":"https://api.github.com/repos/refinery/refinerycms/issues/3171","repository_url":"https://api.github.com/repos/refinery/refinerycms","labels_url":"https://api.github.com/repos/refinery/refinerycms/issues/3171/labels{/name}","comments_url":"https://api.github.com/repos/refinery/refinerycms/issues/3171/comments","events_url":"https://api.github.com/repos/refinery/refinerycms/issues/3171/events","html_url":"https://github.com/refinery/refinerycms/issues/3171","id":153260164,"number":3171,"title":"CVE-2016–3714","user":{"login":"jaredbeck","id":380809,"avatar_url":"https://avatars.githubusercontent.com/u/380809?v=3","gravatar_id":"","url":"https://api.github.com/users/jaredbeck","html_url":"https://github.com/jaredbeck","followers_url":"https://api.github.com/users/jaredbeck/followers","following_url":"https://api.github.com/users/jaredbeck/following{/other_user}","gists_url":"https://api.github.com/users/jaredbeck/gists{/gist_id}","starred_url":"https://api.github.com/users/jaredbeck/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jaredbeck/subscriptions","organizations_url":"https://api.github.com/users/jaredbeck/orgs","repos_url":"https://api.github.com/users/jaredbeck/repos","events_url":"https://api.github.com/users/jaredbeck/events{/privacy}","received_events_url":"https://api.github.com/users/jaredbeck/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/refinery/refinerycms/labels/Needs%20verification","name":"Needs verification","color":"eb6420"}],"state":"closed","locked":false,"assignee":{"login":"parndt","id":10128,"avatar_url":"https://avatars.githubusercontent.com/u/10128?v=3","gravatar_id":"","url":"https://api.github.com/users/parndt","html_url":"https://github.com/parndt","followers_url":"https://api.github.com/users/parndt/followers","following_url":"https://api.github.com/users/parndt/following{/other_user}","gists_url":"https://api.github.com/users/parndt/gists{/gist_id}","starred_url":"https://api.github.com/users/parndt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/parndt/subscriptions","organizations_url":"https://api.github.com/users/parndt/orgs","repos_url":"https://api.github.com/users/parndt/repos","events_url":"https://api.github.com/users/parndt/events{/privacy}","received_events_url":"https://api.github.com/users/parndt/received_events","type":"User","site_admin":false},"milestone":null,"comments":7,"created_at":"2016-05-05T15:43:04Z","updated_at":"2016-05-09T00:06:11Z","closed_at":"2016-05-09T00:06:11Z","body":"Will `refinerycms-images` take any steps to mitigate CVE-2016–3714, aka. \"[imagetragick][1]\"? We could, for example, run `convert -list policy` and make sure it includes output like:\r\n\r\n```\r\n  Policy: Coder\r\n    rights: None \r\n    pattern: EPHEMERAL\r\n  Policy: Coder\r\n    rights: None \r\n    pattern: URL\r\n  Policy: Coder\r\n    rights: None \r\n    pattern: HTTPS\r\n  Policy: Coder\r\n    rights: None \r\n    pattern: MVG\r\n  Policy: Coder\r\n    rights: None \r\n    pattern: MSL\r\n```\r\n\r\nThat's just the first idea that comes to mind. There may be better checks.\r\n\r\n[1]: https://imagetragick.com/"},"comment":{"url":"https://api.github.com/repos/refinery/refinerycms/issues/comments/217754322","html_url":"https://github.com/refinery/refinerycms/issues/3171#issuecomment-217754322","issue_url":"https://api.github.com/repos/refinery/refinerycms/issues/3171","id":217754322,"user":{"login":"parndt","id":10128,"avatar_url":"https://avatars.githubusercontent.com/u/10128?v=3","gravatar_id":"","url":"https://api.github.com/users/parndt","html_url":"https://github.com/parndt","followers_url":"https://api.github.com/users/parndt/followers","following_url":"https://api.github.com/users/parndt/following{/other_user}","gists_url":"https://api.github.com/users/parndt/gists{/gist_id}","starred_url":"https://api.github.com/users/parndt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/parndt/subscriptions","organizations_url":"https://api.github.com/users/parndt/orgs","repos_url":"https://api.github.com/users/parndt/repos","events_url":"https://api.github.com/users/parndt/events{/privacy}","received_events_url":"https://api.github.com/users/parndt/received_events","type":"User","site_admin":false},"created_at":"2016-05-09T00:06:11Z","updated_at":"2016-05-09T00:06:11Z","body":"Closing in favour of #3173"}}