rr- / szurubooru

Image board engine, Danbooru-style.
GNU General Public License v3.0
664 stars 175 forks source link

Allow configuring PIL image size limit #662

Open sobaq opened 1 month ago

sobaq commented 1 month ago

Rehash of #503. Currently uploading very large images can cause the following error:

PIL.Image.DecompressionBombError: Image size (180000000 pixels) exceeds limit of 178956970 pixels, could be decompression bomb DOS attack.
    raise DecompressionBombError(
  File "/usr/lib/python3.8/site-packages/PIL/Image.py", line 2826, in _decompression_bomb_check
    _decompression_bomb_check(im.size)
  File "/usr/lib/python3.8/site-packages/PIL/Image.py", line 2903, in _open_core
    im = _open_core(fp, filename, prefix)
  File "/usr/lib/python3.8/site-packages/PIL/Image.py", line 2916, in open
    img = Image.open(BytesIO(content))
  File "/opt/app/szurubooru/func/image_hash.py", line 43, in _preprocess_image
    im_array = _preprocess_image(content)
  File "/opt/app/szurubooru/func/image_hash.py", line 229, in generate_signature
    query_signature = image_hash.generate_signature(image_content)
  File "/opt/app/szurubooru/func/posts.py", line 931, in search_by_image
    lookalikes = posts.search_by_image(content)
  File "/opt/app/szurubooru/api/post_api.py", line 295, in get_posts_by_image
    response = handler(ctx, match.groupdict())
  File "/opt/app/szurubooru/rest/app.py", line 104, in application
    app_iter = self.channel.server.application(environ, start_response)
  File "/usr/lib/python3.8/site-packages/waitress/task.py", line 441, in execute
    self.execute()
  File "/usr/lib/python3.8/site-packages/waitress/task.py", line 171, in service
    task.service()
  File "/usr/lib/python3.8/site-packages/waitress/channel.py", line 350, in service
Traceback (most recent call last):
[2024-05-19 08:27:38] waitress Exception while serving /posts/reverse-search
[2024-05-19 08:27:38] szurubooru.middleware.request_logger POST /posts/reverse-search (user=redacted, queries=1)

This can be resolved by adding a configuration option to change the PIL constant PIL.Image.MAX_IMAGE_PIXELS.

I'm not sure if the FFMPEG limitation noted in #503 still applies, but I think the option should be exposed either way.