Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

ImageMagick security policy 'PDF' blocking conversion

The Imagemagick security policy seems to be not allowing me perform this conversion from pdf to png. Converting other extensions seem to be working, just not from pdf. I haven't changed any of the imagemagick settings since I installed it... I am using Arch Linux, if the OS matters.

user@machine $ convert -density 300 -depth 8 -quality 90 input.pdf output.png convert: attempt to perform an operation not allowed by the security policy `PDF' @ error/constitute.c/IsCoderAuthorized/408. convert: no images defined `output.png' @ error/convert.c/ConvertImageCommand/3288. 
like image 534
T. Zack Crawford Avatar asked Oct 25 '18 21:10

T. Zack Crawford


People also ask

Can ImageMagick convert PDF?

ImageMagick is a raster processor, not a vector to vector processor. So if you have a vector PDF and you convert it to PDF using ImageMagick, it will rasterize the PDF to pixels (not vectors) and imbed the raster image in a vector PDF shell. That will make the output much larger than the input.

How do I convert a PDF to a PNG in Linux?

When the PDF file is successfully imported, go to the "File" tab and choose "Export To" from the drop-down list. Under the "Export To" drop-down menu, select the "Image" format to access a list of supported image formats. Locate and select the "PNG” option from the list.

Does ImageMagick use GhostScript?

ImageMagick uses GhsotScript for that. So you can't do it with ImageMagick without GhostScript. You can use GhostScript to render PDF to JPG from command line running gswin32.exe (even without ImageMagic) or from your software using gsdll32.

Is ImageMagick secure?

Large image support: read, process, or write mega-, giga-, or tera-pixel image sizes. Threads of execution support: ImageMagick is thread safe and most internal algorithms execute in parallel to take advantage of speed-ups offered by multi-core processor chips.


2 Answers

Well, I added

  <policy domain="coder" rights="read | write" pattern="PDF" /> 

just before </policymap> in /etc/ImageMagick-7/policy.xml and that makes it work again, but not sure about the security implications of that.

like image 123
Stefan Seidel Avatar answered Sep 26 '22 10:09

Stefan Seidel


This issue is a workaround for a security vulnerability. The vulnerability has been addressed in Ghostscript 9.24 (source), so if you have that or a newer version, you don't need the workaround anymore.

On Ubuntu 19.10 through 21.04 and probably any later versions coming with ImageMagick 6, here's how you fix the issue by removing the workaround:

  1. Make sure you have Ghostscript ≥9.24:

    gs --version 
  2. If yes, just remove this whole following section from /etc/ImageMagick-6/policy.xml:

    <!-- disable ghostscript format types --> <policy domain="coder" rights="none" pattern="PS" /> <policy domain="coder" rights="none" pattern="PS2" /> <policy domain="coder" rights="none" pattern="PS3" /> <policy domain="coder" rights="none" pattern="EPS" /> <policy domain="coder" rights="none" pattern="PDF" /> <policy domain="coder" rights="none" pattern="XPS" /> 
like image 28
tanius Avatar answered Sep 26 '22 10:09

tanius