Open homm opened 2 years ago
That's a great observation. This is probably part of the reason most python I/O libraries have separate load(file: IO)
and loads(data: bytes)
and dump
/s
function calls. The other is avoiding path/data ambiguity, which can have some really nasty corner cases (a POSIX path can contain essentially any byte, save for 0x00
IIRC). Basically there is no viable, reliable, unambiguous way to determine if a collection of bytes is a path or just data.
There's a vulnerability for this now getting picked up by threat scanners. FYI.
piexif.load
accepts both filenames and raw data.The malefactor can craft a file with arbitrary
data
in exif chunk of an image.As a result piexif will try to open a file with the path stored in
im.info["exif"]
and also will try to read it.Solution
piexif should newer try to open files when name is
bytes
, notstr
.