Add STRIDE threat model to security docs by aclark4life · Pull Request #9562 · python-pillow/Pillow

aclark4life · 2026-04-14T16:14:53Z

PR docs: https://pillow--9562.org.readthedocs.build/en/9562/handbook/security.html

Changes proposed in this pull request:

Update .github/SECURITY.md with threat model summary and link to handbook
Add docs/handbook/security.rst with full STRIDE analysis (14 threats across Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege categories)
Add prioritised mitigation recommendations
Link security.rst into the handbook toctree

- Update .github/SECURITY.md with threat model summary and link to handbook - Add docs/handbook/security.rst with full STRIDE analysis (14 threats across Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege categories) - Add prioritised mitigation recommendations - Link security.rst into the handbook toctree Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds a STRIDE-based threat model to the Pillow security documentation and links it from the handbook and GitHub Security Policy to help downstream integrators assess and mitigate risks when processing untrusted images.

Changes:

Introduces a new docs/handbook/security.rst page with STRIDE threats and prioritized mitigations.
Adds the security page to the handbook toctree.
Updates .github/SECURITY.md with a threat model summary and link to the handbook page.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
docs/handbook/security.rst	New STRIDE threat model and prioritized mitigation recommendations.
docs/handbook/index.rst	Links the new security page into the handbook navigation.
.github/SECURITY.md	Adds a threat model summary and links to the full handbook page.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

- docs/handbook/security.rst - .github/SECURITY.md Co-authored-by: Andrew Murray <3112309+radarhere@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

radarhere · 2026-04-21T13:42:37Z

+                    ┌──────────────────────────────────────────┐
+                    │  C libraries (bundled or system)         │
+                    │  libjpeg · libpng · libtiff · libwebp    │
+                    │  openjpeg · freetype · littlecms         │


I'm going to be a little picky and suggest littlecms2, rather than littlecms.

If this is intended to be a complete list, then it is missing libimagequant, libraqm, harfbuzz, fribidi, libavif, libxcb and zlib(-ng).

If it's not intended to be a complete list, then I question if libpng should here - it's something that's used by other dependencies, not by used by us directly, so it's not a top tier dependency.

I'm not sure if it's intended to be a complete list and is littlecms2 a newer version of littlecms?

Let's go with not intended to be a complete list.

radarhere · 2026-04-21T13:58:14Z

+**T-3 — Supply chain tampering**
+
+Pre-compiled wheels bundle libjpeg-turbo, libpng, libtiff, libwebp, openjpeg,
+freetype, and littlecms. A compromised PyPI release or build pipeline could


Again, this is not a complete list.

radarhere · 2026-04-21T13:59:55Z

+*Mitigations:* pin with hash verification (``pip install --require-hashes``);
+monitor `Pillow security advisories
+<https://github.com/python-pillow/Pillow/security/advisories>`_; use
+Dependabot or OSV-Scanner for bundled C library CVEs.


Is this document aimed at users? This is mitigation advice for us.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Andrew Murray <3112309+radarhere@users.noreply.github.com>

- Add image.getexif() alongside image._getexif() in T-1 mitigations - Remove 'appended bytes' from T-2 (Pillow does not preserve them on resave) - Reframe R-1 threat as user-facing (not Pillow dev advice); add DecompressionBombError to the log/alert list - Add blank line before E-3 heading - Qualify dependency list in recommendation #4 as non-exhaustive Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Andrew Murray <3112309+radarhere@users.noreply.github.com>

aclark4life · 2026-04-21T15:41:31Z

Comment	Change
Line 74 — mention `getexif()` too	Added `image.getexif()` alongside `image._getexif()` in T-1
Line 80 — "appended bytes" aren't preserved	Removed "appended bytes" from T-2's hidden data list
Line 101 — R-1 reads as advice for Pillow devs	Reframed threat description to be user/application-focused
Line 109 — also log `DecompressionBombError`	Added `Image.DecompressionBombError` to R-1's log/alert list
Line 191 — missing blank line before E-3	Added the blank line
Line 228 — dependency list not complete	Changed to "including … and others" to make it non-exhaustive

RST does not allow inline markup (backticks) nested inside bold markers. Remove backticks from the E-3 and E-4 heading text so they render correctly. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Andrew Murray <3112309+radarhere@users.noreply.github.com>

aclark4life and others added 2 commits April 14, 2026 12:13

Lint

b71b4b9

aclark4life requested a review from Copilot April 14, 2026 23:57

Copilot AI reviewed Apr 15, 2026

View reviewed changes

Comment thread docs/handbook/security.rst Outdated

Comment thread docs/handbook/security.rst Outdated

aclark4life added 🤖-assisted AI-assisted Documentation labels Apr 15, 2026

Copilot started reviewing on behalf of aclark4life April 15, 2026 00:21 View session

radarhere reviewed Apr 15, 2026

View reviewed changes

Comment thread .github/SECURITY.md Outdated

radarhere reviewed Apr 15, 2026

View reviewed changes

Comment thread .github/SECURITY.md Outdated

radarhere reviewed Apr 15, 2026

View reviewed changes

Comment thread docs/handbook/security.rst Outdated

radarhere reviewed Apr 15, 2026

View reviewed changes

Comment thread docs/handbook/security.rst Outdated

radarhere reviewed Apr 15, 2026

View reviewed changes

Comment thread docs/handbook/security.rst Outdated

radarhere reviewed Apr 15, 2026

View reviewed changes

Comment thread docs/handbook/security.rst Outdated

radarhere reviewed Apr 15, 2026

View reviewed changes

Comment thread docs/handbook/security.rst Outdated

aclark4life force-pushed the stride branch from aaba63c to 8a9b0cc Compare April 15, 2026 17:06

aclark4life and others added 2 commits April 15, 2026 13:07

Update docs/handbook/security.rst

b300e78

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update security docs

0c0bdf8

- docs/handbook/security.rst - .github/SECURITY.md Co-authored-by: Andrew Murray <3112309+radarhere@users.noreply.github.com>

aclark4life force-pushed the stride branch from 8a9b0cc to 0c0bdf8 Compare April 15, 2026 17:07

radarhere reviewed Apr 16, 2026

View reviewed changes

Comment thread docs/handbook/security.rst Outdated

aclark4life added 2 commits April 16, 2026 06:45

Remove Sensitive exception messages

07b20b3

Lint

74e07b5

aclark4life marked this pull request as ready for review April 16, 2026 10:48

aclark4life requested review from Copilot, hugovk and radarhere April 21, 2026 13:29

Copilot started reviewing on behalf of aclark4life April 21, 2026 13:29 View session

Copilot AI reviewed Apr 21, 2026

View reviewed changes

Comment thread docs/handbook/security.rst Outdated

Comment thread docs/handbook/security.rst Outdated

radarhere reviewed Apr 21, 2026

View reviewed changes

Comment thread docs/handbook/security.rst Outdated

radarhere reviewed Apr 21, 2026

View reviewed changes

Comment thread docs/handbook/security.rst Outdated

radarhere reviewed Apr 21, 2026

View reviewed changes

Comment thread docs/handbook/security.rst Outdated

radarhere reviewed Apr 21, 2026

View reviewed changes

Comment thread docs/handbook/security.rst Outdated

radarhere reviewed Apr 21, 2026

View reviewed changes

Comment thread docs/handbook/security.rst Outdated

radarhere reviewed Apr 21, 2026

View reviewed changes

Comment thread docs/handbook/security.rst Outdated

radarhere reviewed Apr 21, 2026

View reviewed changes

Comment thread docs/handbook/security.rst Outdated

Update docs/handbook/security.rst

13433dc

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

aclark4life force-pushed the stride branch from 6216428 to 13433dc Compare April 21, 2026 15:10

aclark4life and others added 5 commits April 21, 2026 11:11

s/littlecms/littlecms2/

2911422

docs: list all 8 C extensions in security threat model diagram

114e4d5

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Update docs/handbook/security.rst

1f02641

Co-authored-by: Andrew Murray <3112309+radarhere@users.noreply.github.com>

Update docs/handbook/security.rst

d3b73ea

Co-authored-by: Andrew Murray <3112309+radarhere@users.noreply.github.com>

docs: fix nested inline markup in E-3 and E-4 headings

da06640

RST does not allow inline markup (backticks) nested inside bold markers. Remove backticks from the E-3 and E-4 heading text so they render correctly. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

radarhere reviewed Apr 22, 2026

View reviewed changes

Comment thread docs/handbook/security.rst Outdated

radarhere reviewed Apr 22, 2026

View reviewed changes

Comment thread docs/handbook/security.rst Outdated

radarhere reviewed Apr 22, 2026

View reviewed changes

Comment thread docs/handbook/security.rst Outdated

radarhere reviewed Apr 22, 2026

View reviewed changes

Comment thread docs/handbook/security.rst Outdated

radarhere approved these changes Apr 22, 2026

View reviewed changes

Update docs/handbook/security.rst

0cb00ac

Co-authored-by: Andrew Murray <3112309+radarhere@users.noreply.github.com>

aclark4life force-pushed the stride branch from 6c1733d to 0cb00ac Compare April 22, 2026 16:32

aclark4life merged commit ecef4fb into main Apr 22, 2026
28 of 31 checks passed

aclark4life deleted the stride branch April 22, 2026 16:33

Uh oh!

Conversation

aclark4life commented Apr 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

radarhere Apr 21, 2026

Choose a reason for hiding this comment

Uh oh!

aclark4life Apr 21, 2026

Choose a reason for hiding this comment

Uh oh!

aclark4life Apr 21, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

radarhere Apr 21, 2026

Choose a reason for hiding this comment

Uh oh!

radarhere Apr 21, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

aclark4life commented Apr 21, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

aclark4life commented Apr 14, 2026 •

edited

Loading