Aside from the XML policy, limits can also be set using command-line resource -limit options, MagickCore API methods, or with environment variables. The available environment variables are:
| Variable Name |
Limitation Type |
MAGICK_AREA_LIMIT |
Area |
MAGICK_DISK_LIMIT |
Disk space |
MAGICK_FILE_LIMIT |
Open files |
MAGICK_MEMORY_LIMIT |
Heap memory |
MAGICK_MAP_LIMIT |
Memory map |
MAGICK_THREAD_LIMIT |
Number of threads of execution |
MAGICK_TIME_LIMIT |
Maximum elapsed time in seconds |
You can restrict limits relative to any security policies, but you cannot relax them. For more about ImageMagick's use of resources, see the section
Cache Storage and Resource Requirements on the
Architecture page of the official documentation.
Hardening an ImageMagick installation
Other steps you might want to take:
- Update ImageMagick regularly to apply the latest security fixes
- Use the library programatically, avoiding passing CLI options and sanitizing any filenames before passing them to ImageMagick
- Host the ImageMagick instance in an isolated container, restricting its network perimeter
- Limit the privileges of the user running the library (adopting a least-privileged approach)
- Always explicitly set the input and output image file type. Without an explicit image type in the filename, ImageMagick tries to guess the resource format
- Do not create temporary files in shared directories, instead specify a private area to store only ImageMagick temporary files using CLI options or the XML policy