Secure heic/heif image preview provider

[!TIP]

Help move this idea forward

• Use the 👍 reaction to show support for this feature.
• Avoid commenting unless you have relevant information to add; unnecessary comments create noise for subscribers.
• Subscribe to receive notifications about status changes and new comments.

---

Is your feature request related to a problem? Please describe.

Using a managed nextcloud instance I realized there is no preview provider for heic/heif images enabled by default but was in the past. It was disabled by default because of security and performance concerns https://hackerone.com/reports/1261413 with this PullRequest https://github.com/nextcloud/server/pull/28077

The implementation especially this code block https://github.com/nextcloud/server/blob/5d097ddb4b99673f57b8c085dedd93880ee2539d/lib/private/Preview/HEIC.php#L98-L109 could be used for server-side request forgery by providing malicious SVG file content in a .heic named file.

Describe the solution you'd like

A heic/heif preview provider is shipped which is enabled by default. This assumes there is no known security or performance issue as we saw in the current solution.

A technical solution could make use of encode/decode tool of the libheif https://github.com/strukturag/libheif library.

https://github.com/strukturag/libheif?tab=readme-ov-file#usage:

libheif comes with a set of command line tools:
heif-dec for decoding HEIF images to JPEG or PNG. It can also decode image sequences or MP4 video.

libheif.so is a library used by imagemagic to process heic/heif data. This would require to call a command line tool from PHP layer. Depending on the operating system heif-dec has to be installed separately some examples:

• Debian package in libheif-examples https://packages.debian.org/trixie/amd64/libheif-examples/filelist
• Arch Linux included in libheif https://archlinux.org/packages/extra/x86_64/libheif/

Describe alternatives you've considered

Fixing the current implementation regarding the mentioned concerns. Imagemagic does not provide an interface which allows a sanity check prior to executing the preview generation function. A heic data parser could be used/implemented to provide a sanity check. Specific properties had to be defined first to identify a .heic file without doubt

Additional context

My use-case is uploading images taken by android based smartphones from e.g. Samsung to a managed nextcloud instance by different users. Their default camera apps save photos by default as .heic.

Preview images are not generated as its generation is disabled as stated above. Based on the security concerns enabling the current implementation is not possible within a managed nextcloud environment.

The users would prefer having previews for obvious reasons like quickly looking up specific images.

--> Is there interest in such a solution or does anybody have other suggestions, hints or remarks?

Start by reviewing lib/private/Preview/HEIC.php, especially the linked implementation around lines 98-109, and the libheif heif-dec approach described in the issue. Determine a safe way to decode HEIC/HEIF data without the reported SVG-based SSRF risk. Done means a secure provider can be enabled by default and generates previews for supported HEIC/HEIF uploads without the current security or performance concerns.