fix: strip location only from ExifInterface-writable image formats

EXIF_MIME_TYPES gated the copy-and-strip branch on formats that can
carry GPS, but androidx ExifInterface.saveAttributes() can only rewrite
JPEG, PNG, and WebP. The set omitted PNG (so location-bearing PNGs
uploaded un-stripped, a regression vs. the legacy pipeline) and included
HEIC/HEIF (where saveAttributes throws an IOException that stripLocation
swallows, uploading a still-geotagged copy while appearing to honor the
setting).

Correct the set to {JPEG, PNG, WebP} and cover the PNG-stripped and
HEIC-passthrough cases in the decision-table tests.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: dcalhoun

WordPress/src/main/java/org/wordpress/android/ui/posts/editor/GBKMediaUploadProcessor.kt

@@ -240,8 +240,13 @@ class GBKMediaUploadProcessor(
         private const val MIME_MP4 = "video/mp4"
         private const val MIME_OCTET_STREAM = "application/octet-stream"
 
-        /** Image formats that can carry EXIF GPS metadata. */
-        private val EXIF_MIME_TYPES = setOf(MIME_JPEG, "image/heic", "image/heif", "image/webp")
+        /**
+         * Formats androidx ExifInterface can actually strip GPS from: saveAttributes() supports
+         * only JPEG, PNG, and WebP. HEIC/HEIF are deliberately excluded — the library throws an
+         * IOException (swallowed by stripLocation), so listing them would make a doomed copy and
+         * upload a still-geotagged file while appearing to honor the strip-location setting.
+         */
+        private val EXIF_MIME_TYPES = setOf(MIME_JPEG, MIME_PNG, "image/webp")
     }
 }
 

WordPress/src/test/java/org/wordpress/android/ui/posts/editor/GBKMediaUploadProcessorTest.kt

@@ -119,6 +119,36 @@ class GBKMediaUploadProcessorTest : BaseUnitTest() {
         verify(mediaUtilsWrapper).stripImageLocation(optimized.absolutePath)
     }
 
+    @Test
+    fun `png gps is stripped onto a copy when strip enabled and optimization off`() = test {
+        val pngStaged = tempFolder.newFile("art.png")
+        whenever(mediaUtilsWrapper.getOptimizedMedia(pngStaged.absolutePath, false)).thenReturn(null)
+        whenever(appPrefsWrapper.isStripImageLocation).thenReturn(true)
+
+        // androidx ExifInterface can write PNG, so PNG must take the copy-and-strip branch.
+        val result = createProcessor(wpComSite()).processFile(pngStaged, "image/png", "art.png")
+
+        assertThat(result).isInstanceOf(ProcessedProxyFile.Processed::class.java)
+        result as ProcessedProxyFile.Processed
+        assertThat(result.file.absolutePath).isNotEqualTo(pngStaged.absolutePath)
+        verify(mediaUtilsWrapper).stripImageLocation(result.file.absolutePath)
+        result.file.delete()
+    }
+
+    @Test
+    fun `heic passes through when strip enabled and optimization off`() = test {
+        val heicStaged = tempFolder.newFile("photo.heic")
+        whenever(mediaUtilsWrapper.getOptimizedMedia(heicStaged.absolutePath, false)).thenReturn(null)
+        whenever(appPrefsWrapper.isStripImageLocation).thenReturn(true)
+
+        // androidx ExifInterface cannot write HEIF, so copy-and-strip would silently fail and
+        // upload a still-geotagged copy — HEIC must not take the strip branch.
+        val result = createProcessor(wpComSite()).processFile(heicStaged, "image/heic", "photo.heic")
+
+        assertThat(result).isEqualTo(ProcessedProxyFile.Original)
+        verify(mediaUtilsWrapper, never()).stripImageLocation(any())
+    }
+
     @Test
     fun `heic reports jpeg mime type and extension after optimization`() = test {
         val heicStaged = tempFolder.newFile("photo.heic")