Commit 795f581a8 for imagemagick.org
commit 795f581a890976c38bf9b9da4ac6aa83c6e74889
Author: Cristy <urban-warrior@imagemagick.org>
Date: Thu Feb 5 10:21:48 2026 -0500
clarify path policy
diff --git a/config/policy-secure.xml b/config/policy-secure.xml
index 4f2199699..81d84bed1 100644
--- a/config/policy-secure.xml
+++ b/config/policy-secure.xml
@@ -91,11 +91,11 @@
<!-- Don't read/write from/to stdin/stdout. -->
<policy domain="path" rights="none" pattern="-"/>
<policy domain="path" rights="none" pattern="fd:*"/>
- <!-- don't read sensitive paths. -->
+ <!-- Sensitive paths are not permitted. -->
<policy domain="path" rights="none" pattern="/etc/*"/>
<!-- Relative paths are not permitted. -->
<policy domain="path" rights="none" pattern="*../*"/>
- <!-- Indirect reads are not permitted. -->
+ <!-- Indirect reading is not permitted. -->
<policy domain="path" rights="none" pattern="@*"/>
<!-- These image types are security risks on read, but write is fine -->
<policy domain="module" rights="write" pattern="{MSL,MVG,PS,SVG,URL,XPS}"/>
diff --git a/config/policy-websafe.xml b/config/policy-websafe.xml
index d0a44bf8d..fbec500eb 100644
--- a/config/policy-websafe.xml
+++ b/config/policy-websafe.xml
@@ -87,11 +87,11 @@
<!-- Don't read/write from/to stdin/stdout. -->
<policy domain="path" rights="none" pattern="-"/>
<policy domain="path" rights="none" pattern="fd:*"/>
- <!-- don't read sensitive paths. -->
+ <!-- Sensitive paths are not permitted. -->
<policy domain="path" rights="none" pattern="/etc/*"/>
<!-- Relative paths are not permitted. -->
<policy domain="path" rights="none" pattern="*../*"/>
- <!-- Indirect reads are not permitted. -->
+ <!-- Indirect reading is not permitted. -->
<policy domain="path" rights="none" pattern="@*"/>
<!-- Deny all image modules and specifically exempt reading or writing
web-safe image formats. -->