2

I'm coding an app that allows registered users (anyone who registers) to upload images to my nodejs background (processing with sharpjs)..

I remove the exif section of the image for security. However I have realised that in-fact gps section of exif is extremely neat. Now I'm thinking to keep all of it.

My concern is someone might upload text such as

{
...
GPSSpeed: pornhub.com
GPSLatitudeRef: SOME EXTREME lenght text... 500000k+
...
}

Well you get my fear.

Is my fear legitimate?

My first intuition is too loop all the keys and match them to some schema (lenght, type, maybe even content) , but that would require me creating such a schema.

  • 1
    Why not just use a regex to check that the GPS value fits the format you expect. – Daisetsu Dec 27 '18 at 0:15
  • 1
    So what is your worry, that people will be uploading a lot of junk data in EXIF? – forest Dec 27 '18 at 2:52
  • @forest , Junk and massive chunks of text – Cisum inas Dec 27 '18 at 18:02
  • @daisetsu there is alot of gps data, some seems to be in arrays, other as integer etc – Cisum inas Dec 27 '18 at 18:03
  • @Cisuminas So why not just limit the maximum file upload size? – forest Dec 28 '18 at 1:57
5

Information in EXIF are not free data but have data types. The GPS position information are rational data types expressed as exactly 8 bytes. This means that you cannot put arbitrary string information in it but only floating point numbers.

It might make sense to restrict these values further to sane values. Given that you only want to keep the GPS information of the EXIF metadata it makes sense to extract these, remove the original EXIF data block and write a new one with only the GPS information in it as long as they are within a sane range. There are libraries in a variety of programming languages to do this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.