⬇ Download holy card: ·
Saint ImageTragick, Tragic Mask of Images
Patron of services that resize profile pictures, files that lie about their extension, and shell commands hidden in a drawing.
Life
On 3 May 2016 the world learned that ImageMagick, the library half the web used to resize user uploads, passed bits of the files it processed straight to the shell. A carefully crafted image, perhaps an MVG or SVG dressed up as a JPEG, ran commands on the server as soon as someone tried to make a thumbnail of it. It got a website, a logo and a Greek tragedy for a name.
Prayer
O Saint ImageTragick, who hides the command inside the picture, let our thumbnails remain mere pictures. Amen.
How to celebrate
Celebrated by writing a policy.xml that disables the dangerous coders and checking magic bytes before trusting an extension.
Don't judge a file by its extension.