embedded_attribution 1.0.0-alpha2

Second alpha release of Embedded Attribution. It follows a security review of the alpha1 code and makes the removal of other metadata from derivatives (GPS position, camera serial number, dates, owner) hold in every case, not only when everything goes well.

Alpha: try it on a test or staging site, not yet on a production site. Please report what you find in the issue queue.

What changed

• A derivative that cannot be cleaned is no longer served. In alpha1, a derivative the module could not rewrite was served exactly as the toolkit made it, with all the original's metadata: an original whose metadata could not be read (an XMP packet in Latin-1 was enough), a field value too large for its carrier, a file structure the module does not support. Now an original whose metadata cannot be read gives no attribution but its derivative is still cleaned; an attribution that does not fit is left out and the derivative is still cleaned; and a derivative that cannot be cleaned at all is deleted, the request gets status 500 instead of the image, and the reason is logged. With "Remove other metadata from derivatives" switched off, such a derivative is served as before.
• Stricter about what stays. JPEG: thumbnails in JFXX segments, segments between progressive scans and data after the end of the image go. WebP: second copies of chunks go. AVIF: every item that is not the image goes, and so do top-level boxes such as udta. Only what is listed stays.
• AVIF files that cannot be cleaned safely are refused before anything is written: metadata that shares bytes with the image or lies outside the image data, more than 64 extents per item, an extra image item such as a thumbnail. One crafted case took 30 seconds in alpha1 and is now refused at once.

Upgrading

No database update. Derivatives made by alpha1 keep what is in them until they are made again: press "Refresh existing derivatives" on the settings page after updating.

Requirements

Drupal 11.3 or later, PHP 8.3 or later. Media and Attribution are optional.

Tested

Unit, kernel and exiftool 13.55 test suites on Drupal 11.3 and 11.4, with GD and with ImageMagick; the drupal.org pipeline runs all three. 400,000 mutated JPEG, WebP and AVIF files ran through the new code without an unexpected error.

Known limitations

• Only JPEG originals. Derivatives of other originals, and PNG and GIF derivatives, stay as the toolkit made them.
• Only image style derivatives requested by a visitor. Derivatives made in advance (drush image:derive, modules that generate derivatives ahead of time) are not cleaned, nor are images pasted into body text or downloads of the original.
• The colour profile is kept as it is; it can hold text such as a device model.
• A change of permissions that is not a save of the content is not seen; use the refresh button on the settings page.

AI-Assisted: Yes. I used an AI coding assistant (Claude) to write the code, the tests and these notes. I reviewed, ran and checked everything myself.