Comment

Comment by jcupitt

The fix is pretty easy -- you should call `block_untrusted` to stop loaders like matlab from running:

You can also set the env var `VIPS_BLOCK_UNTRUSTED`, which might be easier.

You can block or allow specific load operations, so you can limit format support to just the types you need:

That might be even better.

There was a post on libvips.org about this a while ago:

And a note about it in the checklist for devs:

parent jcupitt 2 months ago

Discussion