commit 110032f

snac(8): Words of caution for strip_exif configuration

Add words of caution and reasoning to the "strip_exif" configuration for
the server.json file, as these commands would be executed outside of the
sandbox - at least on OpenBSD - and both have quite a history on
security issues due to their huge attack surface and variety of
supported protocols.

After getting comfortable with the related code, I would continue using
it on a personal instance, but would reconsider enabling "strip_exif" on
shared instances with multiple users.

IMO, snac administrators should at least know of potential dangers.

 1@@ -310,6 +310,17 @@ If set to true, EXIF and other metadata will be stripped from uploaded images (j
 2 tools to be installed. If
 3 .Nm snac
 4 cannot find or execute these tools at startup, it will refuse to run.
 5+.Pp
 6+When enabled, registered users might pass arbitrary files to
 7+.Nm mogrify
 8+or
 9+.Nm ffmpeg .
10+These commands are being executed outside the sandbox and have a huge
11+attack surface. Exploits would be run as the
12+.Nm
13+system user. Reconsider enabling this on
14+.Nm
15+instances with unknown or untrusted users.
16 .It Ic mogrify_path
17 Overrides the default "mogrify" command name or path. Use this if the tool is not in the system PATH or has a different name.
18 .It Ic ffmpeg_path