security: sanitize image evidence server-side (Closes #983)

src/image_sanitizer.py

@@ -0,0 +1,38 @@
+"""Authoritative image decoding and metadata removal for evidence uploads."""
+
+from __future__ import annotations
+
+import io
+
+from PIL import Image, ImageOps
+
+
+MAX_IMAGE_PIXELS = 12 * 1024 * 1024
+
+
+def sanitize_image(content_type: str, content: bytes) -> bytes:
+    """Apply orientation and return metadata-free bytes in the claimed format."""
+    format_names = {
+        "image/png": "PNG",
+        "image/jpeg": "JPEG",
+        "image/webp": "WEBP",
+    }
+    try:
+        with Image.open(io.BytesIO(content)) as source:
+            claimed_format = format_names[content_type]
+            if source.format != claimed_format:
+                raise ValueError("image content does not match the selected image type")
+            if getattr(source, "n_frames", 1) != 1:
+                raise ValueError("animated image evidence is not supported")
+            if source.width * source.height > MAX_IMAGE_PIXELS:
+                raise ValueError("attachment must not exceed 12 megapixels")
+            image = ImageOps.exif_transpose(source)
+            image.load()
+            output = io.BytesIO()
+            save_options = {"quality": 90} if claimed_format in {"JPEG", "WEBP"} else {}
+            image.save(output, format=claimed_format, **save_options)
+            return output.getvalue()
+    except ValueError:
+        raise
+    except (KeyError, OSError) as exc:
+        raise ValueError("attachment must be a valid static image") from exc

src/main.py

@@ -41,6 +41,7 @@ from src.gitea_proxy import (
     repos,
 )
 from src.idempotency import IdempotencyLedger, IdempotencyLedgerBusy
+from src.image_sanitizer import sanitize_image
 from src.login_attempt_store import LoginAttemptStore, LoginAttemptStoreError, client_source
 from src.live_snapshot_store import (
     LiveSnapshotMetadata,
@@ -796,6 +797,13 @@ def _validate_binary_attachment(filename: str, content_type: str, content: bytes
     return _validate_attachment_content(content_type, content)
 
 
+async def _sanitize_attachment(content_type: str, content: bytes) -> bytes:
+    sanitized = await asyncio.to_thread(sanitize_image, content_type, content)
+    if len(sanitized) > 2 * 1024 * 1024:
+        raise ValueError("sanitized screenshot must be 2 MB or smaller")
+    return sanitized
+
+
 class IssueCreation(BaseModel):
     title: str = Field(min_length=1, max_length=255)
     body: str = Field(default="", max_length=10_000)
@@ -3157,6 +3165,7 @@ async def attach_to_global_search_preview(
         filename = str(uploaded.filename or "")
         content_type = str(uploaded.content_type or "")
         content = _validate_binary_attachment(filename, content_type, await uploaded.read())
+        content = await _sanitize_attachment(content_type, content)
     except (ValueError, ValidationError) as exc:
         raise HTTPException(status_code=422, detail=str(exc)) from exc
 
@@ -4337,6 +4346,7 @@ async def attach_to_notification(
             filename = attachment.filename
             content_type = attachment.content_type
             content = attachment.content()
+        content = await _sanitize_attachment(content_type, content)
     except (ValueError, ValidationError) as exc:
         raise HTTPException(status_code=422, detail=str(exc)) from exc
 
@@ -5320,6 +5330,7 @@ async def attach_to_assigned_issue(
             filename = attachment.filename
             content_type = attachment.content_type
             content = attachment.content()
+        content = await _sanitize_attachment(content_type, content)
     except (ValueError, ValidationError) as exc:
         raise HTTPException(status_code=422, detail=str(exc)) from exc
     async def upload_attachment():
@@ -5388,6 +5399,7 @@ async def attach_to_assigned_pull(
             filename = attachment.filename
             content_type = attachment.content_type
             content = attachment.content()
+        content = await _sanitize_attachment(content_type, content)
     except (ValueError, ValidationError) as exc:
         raise HTTPException(status_code=422, detail=str(exc)) from exc