<!–

Active Storage's ImageMagick security policy. Applied in addition to the host's policy.xml,
through MAGICK_CONFIGURE_PATH, to every ImageMagick process MiniMagick spawns.

This file must work under both ImageMagick 6 and ImageMagick 7. Use the "coder", "delegate"
and "path" domains, which every release of both honors. A domain one release does not know,
such as "module" on older ImageMagick 6 releases, is ignored rather than rejected.

ImageMagick picks a coder from the file's content, and several coders name the same underlying
reader through different tokens (PS, EPS, EPI, EPSF, EPSI, EPT; PDF, AI, EPDF, PDFA, POCKETMOD). A
coder rule matches one token, so every token is denied by coder.

Do not put a backtick anywhere in this file. ImageMagick's tokenizer treats a backtick as an
opening quote and silently drops every rule up to the next apostrophe.

–> <policymap>

<!-- Scripting coder that reads and writes files named inside the image. -->
<policy domain="coder" rights="none" pattern="MSL"/>

<!-- Coders that read a file, or delete one, other than the image being processed. -->
<policy domain="coder" rights="none" pattern="EPHEMERAL"/>
<policy domain="coder" rights="none" pattern="TEXT"/>

<!-- Coder that reads back a pixel cache from a file the image header names. -->
<policy domain="coder" rights="none" pattern="MPC"/>

<!-- Coders that display to a screen. -->
<policy domain="coder" rights="none" pattern="SHOW"/>
<policy domain="coder" rights="none" pattern="WIN"/>
<policy domain="coder" rights="none" pattern="PLT"/>

<!-- Coders that read a reference from outside the image, remote or local. FILE reads file://. -->
<policy domain="coder" rights="none" pattern="URL"/>
<policy domain="coder" rights="none" pattern="HTTP"/>
<policy domain="coder" rights="none" pattern="HTTPS"/>
<policy domain="coder" rights="none" pattern="FTP"/>
<policy domain="coder" rights="none" pattern="FILE"/>

<!-- Interpreters that read and write files of their own. Ghostscript backs the PS and PDF
     coders and their token aliases; GhostXPS and GhostPCL back XPS and PCL. The "gs" delegate
     covers ImageMagick builds that run Ghostscript as an external command, and the coder rules
     cover builds that link it in-process, where the delegate rule never applies. An
     application that transforms PostScript or PDF through ImageMagick must allow the "gs"
     delegate, and the coders it uses, again in the host's policy.xml. -->
<policy domain="delegate" rights="none" pattern="gs"/>
<policy domain="coder" rights="none" pattern="PS"/>
<policy domain="coder" rights="none" pattern="PS2"/>
<policy domain="coder" rights="none" pattern="PS3"/>
<policy domain="coder" rights="none" pattern="EPS"/>
<policy domain="coder" rights="none" pattern="EPS2"/>
<policy domain="coder" rights="none" pattern="EPS3"/>
<policy domain="coder" rights="none" pattern="EPI"/>
<policy domain="coder" rights="none" pattern="EPSF"/>
<policy domain="coder" rights="none" pattern="EPSI"/>
<policy domain="coder" rights="none" pattern="EPT"/>
<policy domain="coder" rights="none" pattern="EPT2"/>
<policy domain="coder" rights="none" pattern="EPT3"/>
<policy domain="coder" rights="none" pattern="PDF"/>
<policy domain="coder" rights="none" pattern="AI"/>
<policy domain="coder" rights="none" pattern="EPDF"/>
<policy domain="coder" rights="none" pattern="PDFA"/>
<policy domain="coder" rights="none" pattern="POCKETMOD"/>
<policy domain="coder" rights="none" pattern="XPS"/>
<policy domain="coder" rights="none" pattern="PCL"/>

<!-- Indirect reads such as text:@/etc/passwd, which substitute a file for an argument. -->
<policy domain="path" rights="none" pattern="@*"/>

</policymap>