bugGNU Octave - Bugs: bug #49228, imread should only read from a URL...

 
 

bug #49228: imread should only read from a URL if name looks like a URL, only read from a local file otherwise

Submitter:  Mike Miller <mtmiller>
Submitted:  Thu 29 Sep 2016 09:06:47 PM UTC
   
 
Category:  Octave Function Severity:  1 - Wish
Priority:  3 - Low Item Group:  Inaccurate Result
Status:  Fixed Assigned to:  None
Originator Name:  Open/Closed:  * Closed
Release:  * dev Operating System:  * Any
Fixed Release:  None Planned Release:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Sun 26 Feb 2017 11:34:12 PM UTC, comment #7: 

I checked in a change http://hg.savannah.gnu.org/hgweb/octave/rev/e3cb3b761aa7 that passes the tests described in comments #3 and #4.

Rik <rik5>
Group administrator
Wed 16 Nov 2016 07:26:28 PM UTC, comment #6: 

This seems easy enough to fix with a regular expression.  The question is what should the regexp be?

According to https://en.wikipedia.org/wiki/URI_scheme, the most basic form is


scheme:[//[user:password@]host[:port]][/]path[?query][#fragment]


The double forward slash is required by some schemes and not by others, so it can't necessary be used in the regexp.

Because we operate on Windows now, we also have to avoid interping a drive letter specification as a URI scheme.  For example,


C:\windows


which is definitely a path on the local machine.  After checking with Microsoft itself (https://msdn.microsoft.com/en-us/library/windows/desktop/aa365247%28v=vs.85%29.aspx).  It seems that a drive letter is always a single character.

A possible regexp for testing is


fname
is_url = ! isempty (regexp (fname, '^[a-zA-Z][a-zA-Z0-9.+-]+:'));



Rik <rik5>
Group administrator
Mon 03 Oct 2016 07:03:18 PM UTC, comment #5: 

Awesome, thank you anonymous for running those tests!

Mike Miller <mtmiller>
Group Member
Mon 03 Oct 2016 06:30:50 PM UTC, comment #4: 

first one:


Error using imread (line 349)
File "foo.bar" does not exist.

Error in b49228_1 (line 1)
a = imread ('foo.bar')


second one:

Error using imread (line 349)
File "gnu.org/favicon.ico" does not exist.

Error in b49228_2 (line 1)
a = imread ('gnu.org/favicon.ico')


imread('http://www.gnu.org/favicon.ico') does work.

third one, first image call
subdir http: and file google.com in that subdir created.

Error using imread (line 362)
Unable to determine the file format.

Error in b49228_3 (line 5)
a = imread ('http:/google.com')


third one, second image call, whether subdir http:/ exists or not:

Error using imread (line 362)
Unable to determine the file format.

Error in b49228_3_2 (line 1)
b = imread ('http://google.com')


Anonymous
Mon 03 Oct 2016 03:51:36 AM UTC, comment #3: 

That's not really what I was asking.

Does


a = imread ("foo.bar")


send a DNS request? What about


a = imread ("gnu.org/favicon.ico")


How about


mkdir ("http:");
fid = fopen ("http:/google.com", "wb");
fwrite (fid, 0);
fclose (fid);
a = imread ("http:/google.com")
b = imread ("http://google.com")


Mike Miller <mtmiller>
Group Member
Sun 02 Oct 2016 08:39:46 PM UTC, comment #2: 

matlab's urlwrite produces this, confirming it requires a protocol:


>> urlwrite('a b', 'zz.txt')
Error using urlreadwrite (line 38)
Either this URL could not be parsed or the protocol is not supported.

>> urlwrite('ab.png', 'zz.txt')
Error using urlreadwrite (line 38)
Either this URL could not be parsed or the protocol is not supported.


Anonymous
Sun 02 Oct 2016 05:02:40 AM UTC, comment #1: 

Looking at this again, this could be interpreted as an information leak.

For example, if I need to load an image file with a particular name,


>> a = imread ("some_special_image_name.jpg");


If the file does not exist, or if there is a typo in the file name (for example "some_special_image_name.jp"), the name is likely leaked out over the network to one or more configured DNS servers.

Mike Miller <mtmiller>
Group Member
Thu 29 Sep 2016 09:06:47 PM UTC, original submission:  

Following on from bug #49219, I notice that imread attempts to read any string argument as if it's a local file first, then tries to read it using urlwrite, regardless if the string looks like a valid URL or not.

Matlab help for imread hints that it will only attempt to read an image from a URL if it starts with a protocol prefix (e.g. "http://").

Should imread have some kind of pattern / regex logic on the argument to determine whether it looks like a file or a URL?

Should imread attempt to read an argument of "http://foo.jpg" as if it were a local file first? Even if that file exists should it even try to read as a local file or go straight to attempting to download it with urlwrite?

Should imread attempt to read from a URL if called with a simple name of "gnu.org"?

What does Matlab do?

Mike Miller <mtmiller>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by rik5 (Posted a comment)
  • -email is unavailable- added by mtmiller (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only group members can vote.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-02-26 rik5 StatusConfirmed Fixed
        Open/ClosedOpen Closed
    2016-10-03 mtmiller Summaryimread logic to read image from a file vs a URL, always fall back or look for protocol prefix? imread should only read from a URL if name looks like a URL, only read from a local file otherwise
    2016-10-03 mtmiller StatusNeed Info Confirmed
    2016-09-29 mtmiller Priority5 - Normal 3 - Low

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code