Add STRIDE threat model to security docs by aclark4life · Pull Request #9562 · python-pillow/Pillow

aclark4life · 2026-04-14T16:14:53Z

Changes proposed in this pull request:

Update .github/SECURITY.md with threat model summary and link to handbook
Add docs/handbook/security.rst with full STRIDE analysis (14 threats across Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege categories)
Add prioritised mitigation recommendations
Link security.rst into the handbook toctree

- Update .github/SECURITY.md with threat model summary and link to handbook - Add docs/handbook/security.rst with full STRIDE analysis (14 threats across Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege categories) - Add prioritised mitigation recommendations - Link security.rst into the handbook toctree Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds a STRIDE-based threat model to the Pillow security documentation and links it from the handbook and GitHub Security Policy to help downstream integrators assess and mitigate risks when processing untrusted images.

Changes:

Introduces a new docs/handbook/security.rst page with STRIDE threats and prioritized mitigations.
Adds the security page to the handbook toctree.
Updates .github/SECURITY.md with a threat model summary and link to the handbook page.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
docs/handbook/security.rst	New STRIDE threat model and prioritized mitigation recommendations.
docs/handbook/index.rst	Links the new security page into the handbook navigation.
.github/SECURITY.md	Adds a threat model summary and links to the full handbook page.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

docs/handbook/security.rst

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

radarhere · 2026-04-15T12:31:00Z

.github/SECURITY.md

+
 To report sensitive vulnerability information, report it [privately on GitHub](https://github.com/python-pillow/Pillow/security/advisories/new).

 If you cannot use GitHub, use the [Tidelift security contact](https://tidelift.com/security). Tidelift will coordinate the fix and disclosure.


Suggested change

If you cannot use GitHub, use the [Tidelift security contact](https://tidelift.com/security). Tidelift will coordinate the fix and disclosure.

If you cannot use GitHub, use the [Tidelift security contact](https://tidelift.com/docs/security). Tidelift will coordinate the fix and disclosure.

This obviously isn't something you did, but https://tidelift.com/security redirects to https://tidelift.com/docs/security, and it feels neater to change this here than create a new PR

radarhere · 2026-04-15T12:32:22Z

.github/SECURITY.md

+
+## Threat model
+
+Pillow's primary attack surface is parsing untrusted image data. A full STRIDE threat model covering spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege is maintained in the [Security handbook page](https://pillow.readthedocs.io/en/stable/handbook/security.html).


Suggested change

Pillow's primary attack surface is parsing untrusted image data. A full STRIDE threat model covering spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege is maintained in the [Security handbook page](https://pillow.readthedocs.io/en/stable/handbook/security.html).

Pillow's primary attack surface is parsing untrusted image data. A full STRIDE threat model covering spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege is maintained in the [Security handbook page](https://pillow.readthedocs.io/en/latest/handbook/security.html).

If we link to stable, then this link will be broken until July?

radarhere · 2026-04-15T12:33:19Z

docs/handbook/security.rst

+``DecompressionBombError`` at 2× the limit and
+``DecompressionBombWarning`` at 1×. PNG text chunks are


Suggested change

``DecompressionBombError`` at 2× the limit and

``DecompressionBombWarning`` at 1×. PNG text chunks are

``Image.DecompressionBombError`` at 2× the limit and

``Image.DecompressionBombWarning`` at 1×. PNG text chunks are

radarhere · 2026-04-15T12:33:31Z

docs/handbook/security.rst

+runtime or in the reference/source for the current defaults.
+
+*Mitigations:* **never** set ``Image.MAX_IMAGE_PIXELS = None`` in production;
+treat ``DecompressionBombWarning`` as an error; set OS/container memory limits


Suggested change

treat ``DecompressionBombWarning`` as an error; set OS/container memory limits

treat ``Image.DecompressionBombWarning`` as an error; set OS/container memory limits

radarhere · 2026-04-15T12:33:44Z

docs/handbook/security.rst

+   libwebp, openjpeg, freetype, Ghostscript. Subscribe to `Pillow security
+   advisories <https://github.com/python-pillow/Pillow/security/advisories>`_.
+5. **Enforce** ``MAX_IMAGE_PIXELS`` — never set it to ``None``; treat
+   ``DecompressionBombWarning`` as an error.


Suggested change

``DecompressionBombWarning`` as an error.

``Image.DecompressionBombWarning`` as an error.

radarhere · 2026-04-15T12:33:56Z

docs/handbook/security.rst

+10. **Log and alert** on ``DecompressionBombWarning``,
+    ``DecompressionBombError``, ``PIL.UnidentifiedImageError``,


Suggested change

10. **Log and alert** on ``DecompressionBombWarning``,

``DecompressionBombError``, ``PIL.UnidentifiedImageError``,

10. **Log and alert** on ``Image.DecompressionBombWarning``,

``Image.DecompressionBombError``, ``PIL.UnidentifiedImageError``,

radarhere · 2026-04-15T12:34:25Z

docs/handbook/security.rst

+<https://github.com/python-pillow/Pillow/security/advisories/new>`_.
+
+If you cannot use GitHub, use the `Tidelift security contact
+<https://tidelift.com/security>`_. Tidelift will coordinate the fix and


Suggested change

<https://tidelift.com/security>`_. Tidelift will coordinate the fix and

<https://tidelift.com/docs/security>`_. Tidelift will coordinate the fix and

aclark4life and others added 2 commits April 14, 2026 12:13

Lint

b71b4b9

aclark4life requested a review from Copilot April 14, 2026 23:57

Copilot AI reviewed Apr 15, 2026

View reviewed changes

docs/handbook/security.rst Outdated Show resolved Hide resolved

docs/handbook/security.rst Outdated Show resolved Hide resolved

aclark4life and others added 2 commits April 14, 2026 20:08

Update docs/handbook/security.rst

89ebbc7

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update docs/handbook/security.rst

49ce662

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

aclark4life added 🤖-assisted AI-assisted Documentation labels Apr 15, 2026

Copilot started reviewing on behalf of aclark4life April 15, 2026 00:21 View session

radarhere reviewed Apr 15, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add STRIDE threat model to security docs#9562

Add STRIDE threat model to security docs#9562
aclark4life wants to merge 4 commits intomainfrom
stride

aclark4life commented Apr 14, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

radarhere Apr 15, 2026

Uh oh!

radarhere Apr 15, 2026

Uh oh!

radarhere Apr 15, 2026

Uh oh!

radarhere Apr 15, 2026

Uh oh!

radarhere Apr 15, 2026

Uh oh!

radarhere Apr 15, 2026

Uh oh!

radarhere Apr 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants


		To report sensitive vulnerability information, report it [privately on GitHub](https://github.com/python-pillow/Pillow/security/advisories/new).

		If you cannot use GitHub, use the [Tidelift security contact](https://tidelift.com/security). Tidelift will coordinate the fix and disclosure.


		## Threat model

		Pillow's primary attack surface is parsing untrusted image data. A full STRIDE threat model covering spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege is maintained in the [Security handbook page](https://pillow.readthedocs.io/en/stable/handbook/security.html).

		``DecompressionBombError`` at 2× the limit and
		``DecompressionBombWarning`` at 1×. PNG text chunks are

	treat ``DecompressionBombWarning`` as an error; set OS/container memory limits
	treat ``Image.DecompressionBombWarning`` as an error; set OS/container memory limits

	``DecompressionBombWarning`` as an error.
	``Image.DecompressionBombWarning`` as an error.

		10. Log and alert on ``DecompressionBombWarning``,
		``DecompressionBombError``, ``PIL.UnidentifiedImageError``,

	<https://tidelift.com/security>`_. Tidelift will coordinate the fix and
	<https://tidelift.com/docs/security>`_. Tidelift will coordinate the fix and

Uh oh!

Conversation

aclark4life commented Apr 14, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

radarhere Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

radarhere Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

radarhere Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

radarhere Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

radarhere Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

radarhere Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

radarhere Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants