Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove obsolete PDF thumbnail generation feature and Ghostscript dependency #7480

Closed
sengi opened this issue Mar 23, 2023 · 2 comments · Fixed by #9163
Closed

Remove obsolete PDF thumbnail generation feature and Ghostscript dependency #7480

sengi opened this issue Mar 23, 2023 · 2 comments · Fixed by #9163
Assignees
Labels
security Pull requests that address a vulnerability or otherwise improve security

Comments

@sengi
Copy link
Contributor

sengi commented Mar 23, 2023

Whitehall currently uses Ghostscript to generate thumbnail icons for PDF attachments.

It's not clear whether this is even a useful feature (since most document cover pages look very similar and the thumbnail is too small for text to be readable), but if we want to keep generating these thumbnails then it's worth considering switching from Ghostscript to pdf.js to reduce the attack surface.

Ghostscript is 70+ MB of old code, mostly written in C , whereas pdf.js is way smaller and designed for security from the beginning.

See Keith's comment below. We just need to delete the thumbnail code and remove Ghostscript.

@KludgeKML
Copy link
Contributor

KludgeKML commented Jun 13, 2024

Related Issue: #9142

The frontend rendering apps now handle attachments directly, and we just use generic icons. It should now be safe for the whitehall team to remove pre-rendering of attachments and the thumbnail rendering code, and get rid of Ghostscript.

@sengi sengi added the security Pull requests that address a vulnerability or otherwise improve security label Jun 16, 2024
@sengi sengi changed the title Consider using pdf.js for PDF thumbnail generation, or even just use a generic icon instead. Remove obsolete PDF thumbnail generation feature and Ghostscript dependency Jun 16, 2024
@ChrisBAshton
Copy link
Contributor

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
security Pull requests that address a vulnerability or otherwise improve security
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants