search

learning-unlimited / ESP-Website

A website to help manage the logistics of large, short-term educational programs
82 stars 57 forks source link

Upgrade pillow to 7.1.0? #2820

Open willgearty opened 4 years ago

willgearty commented 4 years ago

Apparently there's a low severity security vulnerability in all versions < 6.2.0. We're on 3.3.3, which means upgrading involves a LOT of changes. @hwatheod made the last upgrade to pillow, so maybe he's the best to figure out if we need to address any changes? My understanding is that it's only used for the imagefield in the teacher bios?

Changelog is here: https://github.com/python-pillow/Pillow/blob/master/CHANGES.rst

willgearty commented 3 years ago

Looks like we now need to upgrade to 7.1.0 due to even more security vulnerabilities (although it's unclear to me whether they are relevant to our use case of ImageField). Unfortunately, 7.1.0 dropped support for Python 2.7 (see support here). Looks like our options are:

  1. Upgrade to pillow 6.2.2, which fixes some of the security problems, but not all, but still supports python 2.7.
  2. Wait to upgrade pillow to 7.1.0 when we upgrade to python 3 (https://github.com/learning-unlimited/ESP-Website/issues/2576)
  3. Use FileField (ImageField without the image checks), some derived form of ImageField, or some other implementation of ImageField that doesn't require Pillow (I haven't found any options yet from my limited googling)
  4. Ignore the security vulnerabilities altogether (#1 is probably a better option)
willgearty commented 3 years ago

@hwatheod or @milescalabresi, any thoughts?

milescalabresi commented 3 years ago

I like 3 and 1 (then 2 when the time comes). Do we know how much/severe vulnerability there is in 6.2?

milescalabresi commented 1 month ago

Fixed by #3616. I revise my statement: let's do option 2!