CVE-2022-0881 (TypeScript, published 2022-03-09T09:15Z)
Description: value: Insecure Storage of Sensitive Information in GitHub repository chocobozzz/peertube prior to 4.1.1.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-922 \u2014 Insecure Storage of Sensitive Information
The product stores sensitive information without properly limiting read or write access by unauthorized actors.
Repository: https://github.com/chocobozzz/peertube
Files changed:
.github/actions/reusable-prepare-peertube-run/action.yml
server/helpers/image-utils.ts
server/tests/helpers/image.ts
support/doc/development/tests.md
Commit message: Remove exif tags when processing images


Vulnerable code:
        sudo apt-get install postgresql-client-common redis-tools parallel
  const imageDest = join(imageDestDir, 'test.jpg')
    await processImage(input, imageDest, thumbnailSize, true)
    await checkBuffers(input, imageDest, true)
    await processImage(input, imageDest, thumbnailSize, true)
    await checkBuffers(input, imageDest, false)
    await processImage(input, imageDest, thumbnailSize, true)
    await checkBuffers(input, imageDest, false)
    await processImage(input, imageDest, thumbnailSize, true)
    await checkBuffers(input, imageDest, false)
    await remove(imageDest)
Most of tests can be runned using:

Fixed code:
        sudo apt-get install postgresql-client-common redis-tools parallel libimage-exiftool-perl
  removeExif(sourceImage)

  if (hasExif(sourceImage)) return false

function hasExif (image: Jimp) {
  return !!(image.bitmap as any).exifBuffer
}

function removeExif (image: Jimp) {
  (image.bitmap as any).exifBuffer = null
}
import { execPromise } from '@server/helpers/core-utils'
async function hasTitleExif (path: string) {
  const result = JSON.parse(await execPromise(`exiftool -json ${path}`))

  return result[0]?.Title === 'should be removed'
}


  const imageDestJPG = join(imageDestDir, 'test.jpg')
  const imageDestPNG = join(imageDestDir, 'test.png')

    await processImage(input, imageDestJPG, thumbnailSize, true)
    await checkBuffers(input, imageDestJPG, true)
    await processImage(input, imageDestJPG, thumbnailSize, true)
    await checkBuffers(input, imageDestJPG, false)
    await processImage(input, imageDestJPG, thumbnailSize, true)
    await checkBuffers(input, imageDestJPG, false)
    await processImage(input, imageDestJPG, thumbnailSize, true)

    await checkBuffers(input, imageDestJPG, false)
  })

  it('Should strip exif for a jpg file that can not be copied', async function () {
    const input = buildAbsoluteFixturePath('exif.jpg')
    expect(await hasTitleExif(input)).to.be.true

    await processImage(input, imageDestJPG, { width: 100, height: 100 }, true)
    await checkBuffers(input, imageDestJPG, false)

    expect(await hasTitleExif(imageDestJPG)).to.be.false
  })

  it('Should strip exif for a jpg file that could be copied', async function () {
    const input = buildAbsoluteFixturePath('exif.jpg')
    expect(await hasTitleExif(input)).to.be.true

    await processImage(input, imageDestJPG, thumbnailSize, true)
    await checkBuffers(input, imageDestJPG, false)

    expect(await hasTitleExif(imageDestJPG)).to.be.false
  })

  it('Should strip exif for png', async function () {
    const input = buildAbsoluteFixturePath('exif.png')
    expect(await hasTitleExif(input)).to.be.true
    await processImage(input, imageDestPNG, thumbnailSize, true)
    expect(await hasTitleExif(imageDestPNG)).to.be.false
    await remove(imageDestDir)
Ensure you also have these commands:

```
$ exiftool --help
```

Most of tests can be run using: