我想创建一个验证码图片使用转换从ImageMagick。
我也这么做了,但是有一些问题。
在我的linux shell:
convert -background white -fill black -font FreeSerif-Bold -pointsize 36 label:'adfgh' ./test.png
错误是:
adfgh @ error/constitute.c/ReadImage/453
转换:缺少一个图像文件名。/test.png @
错误/ convert.c / ConvertImageCommand / 3015
我的ImageMagick:版本:6.7.2-7,我安装它yum install ImageMagick。
我笨。有什么建议吗?
投票最高的答案(我没有足够的声誉在那里添加评论)建议注释掉MVG行,但请记住这一点:
CVE-2016-3714
ImageMagick supports ".svg/.mvg" files which means that attackers can
craft code in a scripting language, e.g. MSL (Magick Scripting
Language) and MVG (Magick Vector Graphics), upload it to a server
disguised as an image file and force the software to run malicious
commands on the server side as described above. For example adding the
following commands in a file and uploading it to a webserver that uses
a vulnerable ImageMagick version will result in running the command
"ls -la" on the server.
exploit.jpg:
push graphic-context viewbox 0 0 640 480 fill
'url(https://website.com/image.png"|ls "-la)' pop graphic-context
And
任何低于7.0.1-2或6.9.4-0的版本都有潜在的漏洞
受影响的各方应尽快升级到最新版本
ImageMagick版本。
源