Untrusted input and loader blocking
A service that accepts outside files must limit what the decoder is allowed to do. Since 8.13, libvips can block a set of loaders that have not been fuzzed extensively. That switch is process-wide and does not replace per-request application checks.
The block targets loaders, not business rules
Section titled “The block targets loaders, not business rules”VIPS_BLOCK_UNTRUSTED and vips_block_untrusted_set() tell libvips to refuse a set of operations or loaders marked as untrusted. They do not check:
- whether pixel count, page count, or decode time stays inside the service budget;
- whether the file comes from an allowed store;
- whether the caller may read that object;
- whether GPS and other sensitive metadata must be removed from the output.
Those limits belong in the application’s receive and probe stages. An environment variable or a single call at process start applies to later libvips work in that process; it does not reset itself per request.
Support and boundaries across interfaces
Section titled “Support and boundaries across interfaces”| Interface | Support and boundary in libvips 8.17 / 8.18 |
|---|---|
| vips CLI | VIPS_BLOCK_UNTRUSTED in the process environment applies to the libvips that command is linked against |
| pyvips | Since 2.2.1, block_untrusted_set() and operation_block_set() wrap the underlying libvips controls directly |
| govips v2.19.0 | The public API has no dedicated untrusted wrapper function; processes linked to system libvips can configure VIPS_BLOCK_UNTRUSTED via the process environment |
| sharp 0.35.5 | The prebuilt package ships libvips 8.18.7; verify environment-variable inheritance against the startup sequence in your deployment image |
Operation-level blocking, such as operation_block_set, can disable individual operations by name. Check the operation list against the version you run rather than copying a block list from an older release.
Where this sits in a production pipeline
Section titled “Where this sits in a production pipeline”Handling untrusted uploads requires caps on input bytes, dimensions and total pixels, and page count, as well as ensuring a failed decode never writes a partial response as a success. Streaming has its own cancellation and error path in Reader/Writer streaming I/O. For the full six-stage pipeline structure, see build your first complete image pipeline.
Whether the switch is linked into the process depends on the installation and shared library. Start with install and verify and the version compatibility matrix.